CVE-2026-92459 in yshop-crm
Summary
by MITRE • 09/16/2026
yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmCluesController receiveCustomer endpoint that allows authenticated back-office users to claim sales leads without proper permission checks. Attackers can invoke the lead-claim endpoint to reassign leads from other employees to themselves by overwriting the ownerUserId field, with no access logging or quota validation to prevent bulk lead theft.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in yshop-crm versions through 2.1.3 represents a critical failure in server-side access control mechanisms within the Customer Relationship Management module. Specifically, the CrmCluesController receiveCustomer endpoint lacks proper authorization checks for authenticated back-office users. This architectural flaw allows any user with valid credentials to manipulate business logic by invoking the lead-claim functionality without verifying whether they possess the requisite permissions to claim or reassign specific sales leads. The core technical issue lies in the application's failure to validate that the requesting user is authorized to modify the ownership of a particular record, relying instead on client-supplied data or insufficient server-side validation of role-based access controls.
From an operational perspective, this missing authorization vulnerability enables authenticated attackers to arbitrarily reassign sales leads from other employees to their own accounts by overwriting the ownerUserId field in the database. This action effectively steals potential revenue opportunities and disrupts normal business operations by removing legitimate owners from their assigned tasks. The absence of access logging means that these unauthorized actions leave no audit trail, making it difficult for administrators to detect ongoing exploitation or identify compromised accounts through standard monitoring tools. Furthermore, the lack of quota validation allows attackers to perform bulk lead theft in a single request or rapid sequence of requests, amplifying the impact and potentially causing significant data integrity issues within the sales pipeline.
This vulnerability aligns with CWE-284 Improper Access Control, as it involves a failure to enforce proper restrictions on an authenticated user's actions. It also maps directly to MITRE ATT&CK technique T1078 Valid Accounts, where attackers leverage legitimate credentials to perform unauthorized activities within the system environment. The ability to modify critical business data such as lead ownership without detection underscores the severity of the flaw and its potential for causing substantial financial loss or operational disruption in organizations relying on this CRM software for sales management.
To mitigate this vulnerability, developers must implement strict server-side authorization checks at the CrmCluesController level before processing any request to change lead ownership. This includes verifying that the authenticated user has explicit permission to claim leads and ensuring that they can only modify records assigned to them or within their designated scope of authority. Additionally, comprehensive access logging should be enabled for all critical business operations involving data modification, particularly those affecting financial assets like sales leads. Implementing rate limiting and quota validation on the lead-claim endpoint will further prevent bulk exploitation attempts. Regular security audits and penetration testing focused on broken object level authorization are recommended to ensure that similar gaps do not exist elsewhere in the application logic.