CVE-2026-111703 guchengwuyue CVE debrief

Who should care

Defenders responsible for yshop-crm instances, particularly those handling customer data, should assess exposure and prioritize remediation. This includes verifying yshop-crm version, restricting access to sensitive data, and monitoring for suspicious activity. Security teams and vulnerability management teams should also review the vulnerability and implement necessary controls to prevent exploitation.

Why it matters

CVE-2026-111703 is a medium-severity vulnerability in yshop-crm that allows authenticated users to access and potentially modify other users' customer records. Defenders should verify yshop-crm instances, restrict access to sensitive data, and monitor for suspicious activity.

• Potential unauthorized access to sensitive customer data
• Risk of data overwrite or deletion by malicious users
• Possible exposure of customer information to unintended parties
• Need for verification of yshop-crm version and remediation

Technical summary

The yshop-crm through version 2.1.3 contains an insecure direct object reference (IDOR) vulnerability. This allows authenticated sales users to access other users' customer records by supplying arbitrary IDs to various endpoints, potentially leading to unauthorized data access or modification. The vulnerability enables attackers to read contact details, overwrite or delete customers, or release them into the public pool by exploiting get, update, delete, and do-open endpoints. Defenders should prioritize verifying and remediating this vulnerability in yshop-crm instances, focusing on restricting access to sensitive customer data and monitoring for suspicious activity.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in yshop-crm instances, focusing on restricting access to sensitive customer data.

Recommended defensive actions

• Verify yshop-crm version and restrict access to CRM customer endpoints
• Implement proper authorization checks for customer data access
• Monitor for suspicious activity on customer records
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability allows authenticated sales users to access other users' customer records by supplying arbitrary IDs to get, update, delete, and do-open endpoints, enabling them to read contact details, overwrite or delete customers, or release them into the public pool.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.