CVE-2026-109172mediumCWE-862

CVE-2026-109172: fallo de gravedad media en guchengwuyue yshop-crm

yshop-crm through 2.1.3 Missing Authorization via contract-receivables check endpoint

Publicada el 12 oct 2026

10Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.3

probabilidad de explotación

—

explotación observada

noninguna fuente lo reporta

yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject receivables records by calling POST /admin-api/crm/contract-receivables/check. The handler lacks a @PreAuthorize check and the approver checks in CrmContractReceivablesServiceImpl.check are commented out, so attackers can approve records by id, inflating contract return_money and forging approval logs.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Productos afectados

guchengwuyue · yshop-crm

CVEs relacionadas — guchengwuyue yshop-crm

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-92456HIGHyshop-crm through 2.1.3 Missing Authorization via CRM Customer Rule-Configuration EndpointsEPSS 0.5%CVE-2026-92463HIGHyshop-crm through 2.1.3 Missing Authorization via Disabled Annotation on System User ListingEPSS 0.5%CVE-2026-92460HIGHyshop-crm through 2.1.3 Missing Authorization via CRM Operation-Log ListingEPSS 0.5%CVE-2026-92462HIGHyshop-crm through 2.1.3 Missing Authorization via CrmFlowController deleteFlowStepEPSS 0.4%CVE-2026-92459HIGHyshop-crm through 2.1.3 Missing Authorization via CRM Lead-Claim EndpointEPSS 0.4%CVE-2026-92457HIGHyshop-crm through 2.1.3 Missing Authorization via CrmInvoiceController issueInvoiceEPSS 0.4%

Referencias

https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/yshop-crm/poc_crm_receivables_check.py https://github.com/guchengwuyue/yshop-crm/blob/a77250f7ace63d5b6b363841d9ff441e0e2a9a6b/yshop-crm/sql/yshop-crm-open-source.sql#L2590 https://github.com/guchengwuyue/yshop-crm/blob/a77250f7ace63d5b6b363841d9ff441e0e2a9a6b/yshop-crm/yshop-module-crm/yshop-module-crm-biz/src/main/java/co/yixiang/yshop/module/crm/controller/admin/crmcontractreceivables/CrmContractReceivablesController.java#L79-L85 https://github.com/guchengwuyue/yshop-crm/blob/a77250f7ace63d5b6b363841d9ff441e0e2a9a6b/yshop-crm/yshop-module-crm/yshop-module-crm-biz/src/main/java/co/yixiang/yshop/module/crm/service/crmcontractreceivables/CrmContractReceivablesServiceImpl.java#L228-L327 https://www.vulncheck.com/advisories/yshop-crm-through-2.1.3-missing-authorization-via-contract-receivables-check-endpoint