CVE-2026-111703mediumCWE-639

CVE-2026-111703: falha de média gravidade em guchengwuyue yshop-crm

yshop-crm through 2.1.3 IDOR via CRM customer by-id endpoints

Publicada em

Seguir esta CVE+ Monitorar yshop-crm

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.2%
yshop-crm through 2.1.3 contains an insecure direct object reference vulnerability that allows authenticated sales users to access other users' customer records by supplying arbitrary ids. Attackers can enumerate ids against the get, update, delete and do-open endpoints to read contact details, overwrite or delete customers, or release them into the public pool.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Produtos afetados
guchengwuyue · yshop-crm
CVEs relacionadas — guchengwuyue yshop-crm

No mesmo produto, das mais perigosas para as menos.

CVE-2026-92456HIGHyshop-crm through 2.1.3 Missing Authorization via CRM Customer Rule-Configuration EndpointsEPSS 0.5%CVE-2026-92463HIGHyshop-crm through 2.1.3 Missing Authorization via Disabled Annotation on System User ListingEPSS 0.5%CVE-2026-92460HIGHyshop-crm through 2.1.3 Missing Authorization via CRM Operation-Log ListingEPSS 0.5%CVE-2026-92462HIGHyshop-crm through 2.1.3 Missing Authorization via CrmFlowController deleteFlowStepEPSS 0.4%CVE-2026-92459HIGHyshop-crm through 2.1.3 Missing Authorization via CRM Lead-Claim EndpointEPSS 0.4%CVE-2026-92457HIGHyshop-crm through 2.1.3 Missing Authorization via CrmInvoiceController issueInvoiceEPSS 0.4%