CVE-2026-111703 is a vulnerability in yshop-crm through version 2.1.3, allowing authenticated sales users to access other users' customer records via insecure direct object reference (IDOR) in CRM customer by-id endpoints. This vulnerability enables attackers to enumerate IDs against get, update, delete, and do-open endpoints to read contact details, overwrite or delete customers, or release them into the [truncated]
CVE-2026-92463 is a high-severity vulnerability in yshop-crm, a customer relationship management system. The vulnerability has a CVSS score of 7.1 and allows authenticated back-office users without system:user:list permission to enumerate all users. This could potentially allow attackers with valid back-office credentials and a role with data scope ALL to retrieve sensitive user information.
CVE-2026-92462 debrief: The yshop-crm through 2.1.3 fails to enforce authorization checks on the CrmFlowController deleteFlowStep endpoint, allowing any authenticated back-office user to delete arbitrary approval workflow steps. This vulnerability could disrupt critical business processes such as contract, receivable, and invoice finalization. Defenders should assess exposure and prioritize remediation ef [truncated]
CVE-2026-92458 is a missing authorization vulnerability in the StoreProductController onSale handler of yshop-crm through version 2.1.3. This allows authenticated back-office users to modify product sale status without proper permissions, potentially affecting product catalogs and inventory management. Defenders should assess exposure and verify proper permission checks are in place to prevent unauthorize [truncated]
CVE-2026-92457 is a missing authorization vulnerability in yshop-crm through 2.1.3, specifically in the CrmInvoiceController issueInvoice endpoint. Authenticated back-office users can issue arbitrary invoices by calling the PUT /admin-api/crm/invoice/issue endpoint without required permissions, allowing modification of invoice status, inflation of contract invoiced amounts with attacker-chosen values, and [truncated]
