CVE-2026-92455 in yshop-crm
Summary
by MITRE • 09/16/2026
yshop-crm through 2.1.3 fails to enforce authorization on the sendSms and sendMail endpoints in CrmCustomerController, allowing any authenticated back-office user to send SMS and email to arbitrary customers. Attackers can invoke POST /admin-api/crm/customer/send-sms and POST /admin-api/crm/customer/send-mail with arbitrary customerIds, templateCode, and templateParams to deliver unauthorized messages through the organization's SMS and email channels.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in yshop-crm versions up to 2.1.3 represents a critical failure in access control mechanisms within the Customer Relationship Management module. Specifically, the CrmCustomerController fails to enforce proper authorization checks on its sendSms and sendMail endpoints. This flaw allows any authenticated user with back-office privileges to bypass intended restrictions and interact directly with these communication functions without verifying if they have permission to contact specific customers or use particular messaging templates. The absence of object-level access control means that the application trusts the client-supplied identifiers for customer targets rather than validating them against the current session's permissions or data ownership rules.
From a technical perspective, this is a classic example of an Insecure Direct Object Reference vulnerability where the system does not verify if the authenticated user has the right to perform actions on the specified resource objects. Attackers can exploit this by crafting HTTP POST requests to /admin-api/crm/customer/send-sms and /admin-api/crm/customer/send-mail endpoints. By manipulating parameters such as customerIds, templateCode, and templateParams, an attacker can direct messages to arbitrary recipients outside their authorized scope. This capability effectively turns the organization's internal communication channels into a tool for unauthorized outreach, bypassing any audit trails or approval workflows that might normally govern bulk messaging activities in a CRM system.
The operational impact of this vulnerability is significant, encompassing both security and compliance risks. Unauthorized sending of SMS and email messages can lead to reputational damage if customers receive unsolicited or malicious content originating from the organization's verified channels. Furthermore, it poses a substantial risk for phishing campaigns where attackers impersonate internal staff using trusted sender identities. From a regulatory standpoint, this flaw may violate data protection principles by allowing unauthorized access to customer contact information and misuse of communication infrastructure, potentially leading to non-compliance with standards such as GDPR or CCPA depending on the jurisdiction and nature of the content sent.
This vulnerability aligns closely with CWE-284 Improper Access Control, specifically reflecting a failure in authorization logic where user input is not adequately validated against security policies before processing. In terms of offensive cybersecurity frameworks, this behavior maps to MITRE ATT&CK technique T1534 Internal Spearphishing, as it enables insiders or compromised accounts to launch targeted attacks using legitimate communication channels. It also relates to CWE-602 Client-Side Enforcement of Server-Side Access Control if the restriction was previously attempted on the frontend but not enforced server-side.
To mitigate this vulnerability, developers must implement robust authorization checks within the CrmCustomerController methods for sendSms and sendMail. This involves verifying that the authenticated user has explicit permission to access or message the specific customer IDs provided in the request payload. Implementing role-based access control with granular permissions ensures that only authorized personnel can trigger these communication events. Additionally, applying input validation on template codes and parameters prevents potential injection attacks while ensuring messages are sent through approved channels. Regular security audits and penetration testing of administrative interfaces are recommended to identify similar gaps in other endpoints before they can be exploited by malicious actors seeking to abuse internal systems for external harm.