CVE-2026-92461mediumCWE-862

CVE-2026-92461: medium-severity vulnerability in guchengwuyue yshop-crm

yshop-crm through 2.1.3 Missing Authorization via CRM Approval-Chain Endpoint

Published

Follow this CVE+ Monitor yshop-crm

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 5.3epss 0.4%
yshop-crm through 2.1.3 contains a missing authorization vulnerability in the GET /admin-api/crm/flow/flow-users endpoint that allows any logged-in back-office user to access approval workflow data. Attackers can retrieve approval chain topology, step ordering, approver identifiers, and personal information including login names, nicknames, departments, email addresses, mobile numbers and last login IP addresses.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
guchengwuyue · yshop-crm
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — guchengwuyue yshop-crm

In the same product, most dangerous first.

CVE-2026-92456HIGHyshop-crm through 2.1.3 Missing Authorization via CRM Customer Rule-Configuration EndpointsEPSS 0.5%CVE-2026-92463HIGHyshop-crm through 2.1.3 Missing Authorization via Disabled Annotation on System User ListingEPSS 0.5%CVE-2026-92460HIGHyshop-crm through 2.1.3 Missing Authorization via CRM Operation-Log ListingEPSS 0.5%CVE-2026-92462HIGHyshop-crm through 2.1.3 Missing Authorization via CrmFlowController deleteFlowStepEPSS 0.4%CVE-2026-92459HIGHyshop-crm through 2.1.3 Missing Authorization via CRM Lead-Claim EndpointEPSS 0.4%CVE-2026-92457HIGHyshop-crm through 2.1.3 Missing Authorization via CrmInvoiceController issueInvoiceEPSS 0.4%