CVE-2026-92458 — yshop-crm through 2.1.3 Missing Authorization via StoreProductController onSale
yshop-crm through 2.1.3 contains a missing authorization vulnerability in the StoreProductController onSale handler that allows authenticated back-office users to modify product…
Published: 2026-09-16 · CVSS: 5.3 · CVSS 4.0
yshop-crm through 2.1.3 contains a missing authorization vulnerability in the StoreProductController onSale handler that allows authenticated back-office users to modify product sale status. Attackers can invoke the GET /admin-api/product/store-product/sale endpoint with sequential product IDs to withdraw entire product catalogs from sale or re-enable withdrawn products without proper permission checks.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7