CVE-2026-92461mediumCWE-862

CVE-2026-92461: fallo de gravedad media en guchengwuyue yshop-crm

yshop-crm through 2.1.3 Missing Authorization via CRM Approval-Chain Endpoint

Publicada el

Seguir esta CVE+ Monitorear yshop-crm

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

33Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 5.3epss 0.4%
yshop-crm through 2.1.3 contains a missing authorization vulnerability in the GET /admin-api/crm/flow/flow-users endpoint that allows any logged-in back-office user to access approval workflow data. Attackers can retrieve approval chain topology, step ordering, approver identifiers, and personal information including login names, nicknames, departments, email addresses, mobile numbers and last login IP addresses.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Productos afectados
guchengwuyue · yshop-crm
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — guchengwuyue yshop-crm

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-92456HIGHyshop-crm through 2.1.3 Missing Authorization via CRM Customer Rule-Configuration EndpointsEPSS 0.5%CVE-2026-92463HIGHyshop-crm through 2.1.3 Missing Authorization via Disabled Annotation on System User ListingEPSS 0.5%CVE-2026-92460HIGHyshop-crm through 2.1.3 Missing Authorization via CRM Operation-Log ListingEPSS 0.5%CVE-2026-92462HIGHyshop-crm through 2.1.3 Missing Authorization via CrmFlowController deleteFlowStepEPSS 0.4%CVE-2026-92459HIGHyshop-crm through 2.1.3 Missing Authorization via CRM Lead-Claim EndpointEPSS 0.4%CVE-2026-92457HIGHyshop-crm through 2.1.3 Missing Authorization via CrmInvoiceController issueInvoiceEPSS 0.4%