CVE-2026-92463 guchengwuyue CVE debrief

Who should care

Defenders responsible for yshop-crm instances, particularly those with back-office access, should assess their exposure to this vulnerability. System administrators and security teams should verify the presence of this vulnerability in their environments and take necessary actions to prevent exploitation.

Why it matters

CVE-2026-92463 is a high-severity vulnerability in yshop-crm that allows authenticated back-office users to enumerate all users, potentially exposing sensitive user information. Defenders should prioritize verifying the presence of this vulnerability and ensuring that users with back-office access do not have unnecessary permissions.

• Potential unauthorized enumeration of user directories
• Exposure of sensitive user information
• Increased risk of targeted attacks using valid back-office credentials
• Need for verification of yshop-crm version and user permissions

Technical summary

The yshop-crm system through version 2.1.3 contains an authorization failure in the GET /admin-api/system/user/page endpoint. The @PreAuthorize annotation is commented out, allowing authenticated back-office users without system:user:list permission to enumerate all users. Attackers with valid back-office credentials and a role with data scope ALL can retrieve the complete user directory, including sensitive information such as login names, nicknames, departments, email addresses, mobile numbers, and last login information.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their yshop-crm instances and ensuring that users with back-office access do not have unnecessary permissions.

Recommended defensive actions

• Verify the presence of this vulnerability in yshop-crm instances
• Ensure users with back-office access do not have unnecessary permissions
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, including its CVSS score and a brief description. However, the exact scope of affected versions and potential impact on specific systems is not explicitly stated.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.