CVE-2026-92456 — yshop-crm through 2.1.3 Missing Authorization via CRM Customer Rule-Configuration Endpoints
yshop-crm through 2.1.3 fails to enforce authorization on the saveRedisSet and getRedisSet endpoints in CrmCustomerController, allowing any authenticated back-office user to rea…
Published: 2026-09-16 · CVSS: 7.1 · CVSS 4.0
yshop-crm through 2.1.3 fails to enforce authorization on the saveRedisSet and getRedisSet endpoints in CrmCustomerController, allowing any authenticated back-office user to read and modify installation-wide lead-allocation and customer auto-recycling policy. Attackers can invoke these endpoints to manipulate shared Redis keys controlling customer auto-recycling behavior, causing mass customer data deletion, disabling lead recycling, or blocking customer creation across the deployment.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7