CVE-2026-92463 — yshop-crm through 2.1.3 Missing Authorization via Disabled Annotation on System User Listing
yshop-crm through 2.1.3 contains an authorization failure in the GET /admin-api/system/user/page endpoint where the @PreAuthorize annotation is commented out, allowing authentic…
Published: 2026-09-16 · CVSS: 7.1 · CVSS 4.0
yshop-crm through 2.1.3 contains an authorization failure in the GET /admin-api/system/user/page endpoint where the @PreAuthorize annotation is commented out, allowing authenticated back-office users without system:user:list permission to enumerate all users. Attackers with valid back-office credentials and a role with data scope ALL can retrieve the complete user directory including login names, nicknames, departments, email addresses, mobile numbers, and last login information.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7