CVE-2026-92461 in yshop-crm
Summary
by MITRE • 09/16/2026
yshop-crm through 2.1.3 contains a missing authorization vulnerability in the GET /admin-api/crm/flow/flow-users endpoint that allows any logged-in back-office user to access approval workflow data. Attackers can retrieve approval chain topology, step ordering, approver identifiers, and personal information including login names, nicknames, departments, email addresses, mobile numbers and last login IP addresses.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in yshop-crm versions through 2.1.3 represents a critical failure in access control mechanisms within the customer relationship management module. Specifically, the GET /admin-api/crm/flow/flow-users endpoint lacks proper authorization checks to ensure that the requesting user has the requisite permissions to view sensitive workflow data. This flaw allows any authenticated back-office user, regardless of their specific role or privilege level, to retrieve detailed information regarding approval workflows. The absence of server-side validation means that an attacker with valid credentials for a low-privilege account can exploit this endpoint to gather intelligence on higher-level administrative processes and personnel structures without triggering security alerts or access denials.
The technical nature of this flaw aligns directly with CWE-284, which classifies Improper Access Control, specifically focusing on the failure to enforce restrictions on authenticated users regarding what data they can access. By exploiting this missing authorization check, an attacker gains visibility into the approval chain topology and step ordering, effectively mapping out how decisions are made within the organization's operational framework. Furthermore, the endpoint exposes a significant amount of personally identifiable information (PII) associated with approvers. This includes login names, nicknames, departmental affiliations, email addresses, mobile phone numbers, and last known IP addresses. The exposure of such granular personal data transforms what might otherwise be an internal process visibility issue into a severe privacy violation and potential compliance breach under regulations like GDPR or CCPA.
From an operational perspective, the impact of this vulnerability extends beyond simple data leakage. Knowledge of the approval chain topology allows attackers to understand the hierarchy and decision-making paths within the organization's CRM system. This intelligence can be leveraged for targeted social engineering attacks, such as spear phishing or business email compromise (BEC), where adversaries impersonate specific approvers based on their revealed roles and contact details. The disclosure of last login IP addresses further aids in identifying active users and potentially correlating them with physical locations or network segments, facilitating more sophisticated lateral movement if the attacker gains deeper access to the internal network. This behavior is consistent with ATT&CK technique T1078, Valid Accounts, where attackers use legitimate credentials to move laterally and gather information for subsequent exploitation phases.
Mitigation strategies must prioritize immediate remediation of the authorization logic within the affected endpoint. Developers should implement strict role-based access control (RBAC) checks that verify whether the authenticated user possesses specific permissions required to view workflow data before returning any response. It is essential to ensure that these checks are performed on the server side and cannot be bypassed by manipulating request parameters or headers. Additionally, a comprehensive audit of all API endpoints should be conducted to identify similar patterns where authorization controls may have been inadvertently omitted during development. To reduce the blast radius in the event of future vulnerabilities, sensitive fields such as mobile numbers and IP addresses should be excluded from standard response payloads unless explicitly required by high-privilege roles. Implementing robust logging and monitoring for unauthorized access attempts will also aid in detecting exploitation activities early.