CVE-2026-92461
yshop-crm through 2.1.3 Missing Authorization via CRM Approval-Chain Endpoint
- State
- Published
- Severity
- 5.3 Medium
- Published
- Sep 16, 2026
- Updated
- Sep 16, 2026
- Reserved
- Sep 16, 2026
Description
yshop-crm through 2.1.3 contains a missing authorization vulnerability in the GET /admin-api/crm/flow/flow-users endpoint that allows any logged-in back-office user to access approval workflow data. Attackers can retrieve approval chain topology, step ordering, approver identifiers, and personal information including login names, nicknames, departments, email addresses, mobile numbers and last login IP addresses.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | VulnCheck |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
yshop-crmguchengwuyue |
|
References
- Reporter proof of concept: approval-chain disclosure via /crm/flow/flow-usersexploit
- getFlowUserIds declared without @PreAuthorize while the narrower flow-step listing requires crm:flow:querytechnical-description
- getFlowUserIds resolves adminIds to full approver user records with no caller checktechnical-description
- Maven revision property showing the affected tree is version 2.1.3technical-description
- yshop-crm source repositoryproduct
- VulnCheck Advisory: yshop-crm through 2.1.3 Missing Authorization via CRM Approval-Chain Endpointthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.