CVE-2026-92457 guchengwuyue CVE debrief

Who should care

Defenders responsible for yshop-crm deployments, especially those with authenticated back-office users, should assess exposure and prioritize remediation. This includes reviewing system configurations, verifying user access controls, and ensuring that only authorized users can access the CrmInvoiceController issueInvoice endpoint. Additionally, defenders should monitor for suspicious activity and consider upgrading to a non-vulnerable version of yshop-crm.

Why it matters

CVE-2026-92457 is a missing authorization vulnerability in yshop-crm that allows authenticated back-office users to issue arbitrary invoices, potentially leading to financial and reputational impacts.

• Attackers can modify invoice status without required permissions.
• Attackers can inflate contract invoiced amounts with attacker-chosen values.
• Attackers can trigger invoice emails to arbitrary addresses.
• Defenders need to verify and remediate this vulnerability to prevent potential financial and reputational impacts.

Technical summary

The CrmInvoiceController issueInvoice endpoint in yshop-crm through version 2.1.3 does not properly check permissions, allowing authenticated back-office users to issue arbitrary invoices. This vulnerability could be exploited to modify invoice status, inflate contract invoiced amounts, and trigger invoice emails without required permissions. The issue arises from inadequate authorization checks in the endpoint, which could be addressed by implementing proper permission checks and restricting access to authorized users.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability, especially in environments where authenticated back-office users have access to the affected endpoint.

Recommended defensive actions

• Verify the version of yshop-crm in use and check if it is vulnerable (version 2.1.3 or earlier).
• Restrict access to the CrmInvoiceController issueInvoice endpoint to only users with required permissions.
• Monitor for suspicious activity on the affected endpoint.
• Consider upgrading to a version of yshop-crm that is not vulnerable.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability allows attackers to call the PUT /admin-api/crm/invoice/issue endpoint without required permissions, enabling them to modify invoice status, inflate contract invoiced amounts with attacker-chosen values, and trigger invoice emails to arbitrary addresses.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.