CVE-2026-92456
CVE-2026-92456
yshop-crm through 2.1.3 fails to enforce authorization on the saveRedisSet and getRedisSet endpoints in CrmCustomerController, allowing any authenticated back-office user to read and modify installation-wide lead-allocation and customer auto-recycling policy. Attackers can invoke these endpoints to manipulate shared Redis keys controlling customer auto-recycling behavior, causing mass customer data deletion, disabling lead recycling, or blocking customer creation across the deployment.
Vulnerability class: Broken Access Control
CVSS v3 metric
CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L.
Weakness classification (CWE)
References
- disclosure@vulncheck.com (exploit)
- disclosure@vulncheck.com (technical-description)
- disclosure@vulncheck.com (technical-description)
- disclosure@vulncheck.com (technical-description)
- disclosure@vulncheck.com (technical-description)
- disclosure@vulncheck.com (product)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2026-92456?
- CVE-2026-92456 is a high-severity vulnerability, classified under Missing Authorization. CVSS score: 7.1/10. Published 2026-09-16.
- How severe is CVE-2026-92456?
- High severity. CVSS v3 base score is 7.1 out of 10.