CVE-2026-92458

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the StoreProductController onSale handler that allows authenticated back-office users to modify product sale status. Attackers can invoke the GET /admin-api/product/store-product/sale endpoint with sequential product IDs to...

CVE-2026-92458

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the StoreProductController onSale handler. The endpoint GET /admin-api/product/store-product/sale lacks proper permission checks, allowing authenticated back-office users to iterate sequential product IDs to withdraw entire...