Login Request a demo
Medium severity · published Sep 16, 2026
CVE-2026-92461
yshop-crm through 2.1.3 Missing Authorization via CRM Approval-Chain Endpoint
4.3
CVSS
0.4%
EPSS
No
On KEV
Description
yshop-crm through 2.1.3 contains a missing authorization vulnerability in the GET /admin-api/crm/flow/flow-users endpoint that allows any logged-in back-office user to access approval workflow data. Attackers can retrieve approval chain topology, step ordering, approver identifiers, and personal information including login names, nicknames, departments, email addresses, mobile numbers and last login IP addresses.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
YS
yshop-crm · guchengwuyue
through 2.1.3 · source: vendor
Affected product
YS
yshop-crm
guchengwuyue
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-92461
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-92461
github.com
https://github.com/LinYuanyi1/cve-request-poc/blob/master/yshop-crm/C08_crm_flow_users.py
github.com
https://github.com/guchengwuyue/yshop-crm
github.com
https://github.com/guchengwuyue/yshop-crm/blob/5f5810a0e1e4ab0828523ec299bf973c2f9065d7/yshop-crm/pom.xml#L30
github.com
https://github.com/guchengwuyue/yshop-crm/blob/5f5810a0e1e4ab0828523ec299bf973c2f9065d7/yshop-crm/yshop-module-crm/yshop-module-crm-biz/src/main/java/co/yixiang/yshop/module/crm/controller/admin/crmflow/CrmFlowController.java#L94
github.com
https://github.com/guchengwuyue/yshop-crm/blob/5f5810a0e1e4ab0828523ec299bf973c2f9065d7/yshop-crm/yshop-module-crm/yshop-module-crm-biz/src/main/java/co/yixiang/yshop/module/crm/service/crmflow/CrmFlowServiceImpl.java#L132
www.vulncheck.com
https://www.vulncheck.com/advisories/yshop-crm-through-2.1.3-missing-authorization-via-crm-approval-chain-endpoint
More from yshop-crm
7.1
CVE-2026-92456
yshop-crm through 2.1.3 Missing Authorization via CRM Customer Rule-Configuration Endpoints
6.5
CVE-2026-92463
yshop-crm through 2.1.3 Missing Authorization via Disabled Annotation on System User Listing
6.5
CVE-2026-92462
yshop-crm through 2.1.3 Missing Authorization via CrmFlowController deleteFlowStep
6.5
CVE-2026-92460
yshop-crm through 2.1.3 Missing Authorization via CRM Operation-Log Listing
6.5
CVE-2026-92459
yshop-crm through 2.1.3 Missing Authorization via CRM Lead-Claim Endpoint