CVE-2026-92459 — yshop-crm through 2.1.3 Missing Authorization via CRM Lead-Claim Endpoint
yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmCluesController receiveCustomer endpoint that allows authenticated back-office users to claim sa…
Published: 2026-09-16 · CVSS: 7.1 · CVSS 4.0
yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmCluesController receiveCustomer endpoint that allows authenticated back-office users to claim sales leads without proper permission checks. Attackers can invoke the lead-claim endpoint to reassign leads from other employees to themselves by overwriting the ownerUserId field, with no access logging or quota validation to prevent bulk lead theft.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7