CVE-2026-92456 in yshop-crm
Summary
by MITRE • 09/16/2026
yshop-crm through 2.1.3 fails to enforce authorization on the saveRedisSet and getRedisSet endpoints in CrmCustomerController, allowing any authenticated back-office user to read and modify installation-wide lead-allocation and customer auto-recycling policy. Attackers can invoke these endpoints to manipulate shared Redis keys controlling customer auto-recycling behavior, causing mass customer data deletion, disabling lead recycling, or blocking customer creation across the deployment.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in yshop-crm versions up to 2.1.3 represents a critical failure in server-side access control within the Customer Relationship Management module. Specifically, the CrmCustomerController exposes two endpoints, saveRedisSet and getRedisSet, which interact with shared Redis keys that govern system-wide operational policies regarding lead allocation and customer auto-recycling mechanisms. These functions are designed to manage configuration data that affects the entire deployment rather than individual user contexts. However, the implementation fails to enforce proper authorization checks on these specific API endpoints, allowing any authenticated back-office user to read or modify these critical settings regardless of their assigned role or permissions within the application hierarchy.
This lack of function-level access control enables an attacker with valid credentials for a low-privilege administrative account to manipulate shared state variables that dictate how customer data is processed and retained. By invoking the getRedisSet endpoint, an adversary can retrieve sensitive configuration details regarding lead distribution logic and recycling policies. More critically, through the saveRedisSet endpoint, the attacker can overwrite these values with malicious inputs. This capability transforms a standard authentication bypass into a severe integrity violation, as it allows unauthorized modification of system behavior that impacts all users and customers within the platform.
The operational impact of this vulnerability is substantial due to its scope affecting installation-wide settings rather than isolated user data. An attacker exploiting the saveRedisSet endpoint can disable customer auto-recycling features, which may lead to database bloat or prevent legitimate business processes from executing as intended. Conversely, an attacker could manipulate these keys to trigger mass deletion of customer records by altering recycling parameters incorrectly. Furthermore, blocking customer creation across the deployment is a feasible outcome if the manipulated Redis state interferes with validation logic tied to these shared settings. This results in significant disruption to business operations, potential loss of critical client data, and degradation of service availability for all stakeholders relying on the CRM system.
From a classification perspective, this flaw aligns directly with CWE-284 Improper Access Control, as it involves unauthorized modification of resources due to insufficient enforcement of user permissions. It also maps to MITRE ATT&CK technique T1078 Valid Accounts, where an attacker leverages legitimate credentials to perform actions outside their intended scope. The exploitation relies on the manipulation of server-side state via API endpoints, highlighting a common pitfall in web application development where backend services are exposed without adequate role-based access control validation.
To mitigate this vulnerability, developers must implement strict authorization checks on all administrative and configuration-related endpoints within the CrmCustomerController. This involves verifying that the authenticated user possesses specific high-level privileges required to modify system-wide settings before processing requests to saveRedisSet or getRedisSet. Additionally, implementing role-based access control policies at the framework level can prevent lower-privilege users from accessing sensitive management functions. Input validation should also be applied to ensure that data written to Redis keys conforms to expected formats and values, preventing malicious payloads from corrupting system logic. Regular security audits focusing on API endpoint permissions are recommended to identify similar gaps in access control across other modules of the application.