CVE-2026-92463 in yshop-crm
Summary
by MITRE • 09/16/2026
yshop-crm through 2.1.3 contains an authorization failure in the GET /admin-api/system/user/page endpoint where the @PreAuthorize annotation is commented out, allowing authenticated back-office users without system:user:list permission to enumerate all users. Attackers with valid back-office credentials and a role with data scope ALL can retrieve the complete user directory including login names, nicknames, departments, email addresses, mobile numbers, and last login information.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in yshop-crm versions through 2.1.3 represents a critical authorization failure within the administrative backend interface. Specifically, the GET /admin-api/system/user/page endpoint is designed to provide paginated access to user data for system administrators and authorized personnel. However, due to a configuration error where the @PreAuthorize annotation was commented out during development or deployment, the framework fails to enforce the necessary security checks before processing requests. This oversight effectively removes the gatekeeping mechanism that restricts access based on specific role permissions, such as system:user:list. Consequently, any authenticated user with valid back-office credentials can interact with this endpoint without possessing the explicit permission required to view sensitive user information.
From a technical perspective, the flaw stems from the improper handling of Spring Security annotations in the Java-based backend architecture. The @PreAuthorize annotation is typically used to declaratively define access control rules at the method level, ensuring that only users meeting specific criteria can execute certain actions. When this annotation is disabled or commented out, the application relies on default behaviors or lacks explicit restrictions entirely for that particular route. This allows attackers who have obtained valid credentials through phishing, credential stuffing, or other means to bypass intended access controls. The vulnerability specifically impacts authenticated back-office users whose roles are configured with a data scope of ALL, enabling them to retrieve comprehensive user directories including login names, nicknames, departmental affiliations, email addresses, mobile numbers, and last login timestamps.
The operational impact of this vulnerability is significant due to the sensitivity of the exposed data. The ability to enumerate all users provides attackers with valuable intelligence for further attacks, such as targeted phishing campaigns or credential-based assaults against high-privilege accounts. By obtaining a complete list of usernames and contact information, adversaries can craft highly personalized social engineering messages that appear legitimate to victims. Furthermore, access to last login times helps attackers identify active sessions and potentially time their own intrusion attempts to coincide with periods of low activity or when administrators are less likely to monitor logs closely. This level of information disclosure violates the principle of least privilege and compromises the confidentiality integrity of the system's user management module.
In terms of industry standards, this vulnerability aligns with CWE-285 Improper Authorization, as the application fails to properly enforce access control policies for authenticated users. It also relates to CWE-601 URL Redirection to Untrusted Site (Open Redirect) if combined with other flaws, but primarily it is a direct example of broken access control where role-based restrictions are bypassed. From an ATT&CK perspective, this behavior corresponds to T1078 Valid Accounts, as the attacker leverages legitimate credentials to gain unauthorized access to resources, and potentially T1005 Data from Local System if used in conjunction with other exfiltration techniques. The exposure of personally identifiable information also raises concerns regarding compliance with data protection regulations such as GDPR or CCPA, depending on the jurisdiction and nature of the stored user data.
To mitigate this vulnerability, immediate action is required to restore the security controls within the application codebase. Developers should uncomment the @PreAuthorize annotation for the affected endpoint and ensure that it correctly references the system:user:list permission requirement. Additionally, a thorough audit of all other endpoints in the admin API should be conducted to identify similar instances where authorization checks may have been inadvertently disabled or misconfigured. Implementing strict input validation and ensuring that role-based access control policies are consistently applied across all administrative functions will help prevent recurrence. Regular security testing, including penetration tests focused on broken access control scenarios, is recommended to verify the effectiveness of these remediation efforts and maintain a robust security posture for the yshop-crm platform.