CVE-2026-92458 guchengwuyue CVE debrief

Who should care

Defenders responsible for yshop-crm deployments, especially those with authenticated back-office users, should assess exposure and verify proper permission checks are in place to prevent potential unauthorized changes to product sale status. This includes reviewing and restricting access to product sale status modification functionality, implementing proper permission checks, and monitoring and auditing product sale status modifications for unauthorized  

Why it matters

CVE-2026-92458 is a missing authorization vulnerability in yshop-crm that allows authenticated back-office users to modify product sale status without proper permissions. Defenders responsible for yshop-crm deployments should assess exposure and verify proper permission checks are in place to prevent potential unauthorized changes to product sale status.

• Potential unauthorized modification of product sale status by authenticated back-office users
• Possible withdrawal of entire product catalogs from sale or re-enabling of withdrawn products without proper permissions

Technical summary

The vulnerability exists in the StoreProductController onSale handler of yshop-crm through version 2.1.3. Authenticated back-office users can modify product sale status without proper permission checks by invoking the GET /admin-api/product/store-product/sale endpoint with sequential product IDs. This could lead to potential unauthorized modification of product sale status, possible withdrawal of entire product catalogs from sale, or re-enabling of withdrawn products without proper permissions. Defenders should prioritize verifying and restricting access to product sale status modification functionality, especially for authenticated back-office users.

Defensive priority

Defenders should prioritize verifying and restricting access to product sale status modification functionality, especially for authenticated back-office users.

Recommended defensive actions

• Verify and restrict access to product sale status modification functionality for authenticated back-office users
• Implement proper permission checks for modifying product sale status
• Monitor and audit product sale status modifications for unauthorized changes
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is confirmed in yshop-crm version 2.1.3. Exploitation and impact details are limited in the provided source corpus. Defenders should verify the affected product deployments exist in managed environments and review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. The vulnerability allows authenticated back-office users to modify product sale status without proper permission checks by invoking the GET /admin-api/product/store-product/sale endpoint with sequential  

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.