Guchengwuyue Yshop-Crm
8 CVEs affecting Guchengwuyue Yshop-Crm. Latest disclosed: 2026-10-16. Critical: 0, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-92463 | Medium | 6.5 | 2026-09-16 | yshop-crm through 2.1.3 contains an authorization failure in the GET /admin-api/system/user/page endpoint where the @PreAuthorize annotation is commented out… |
CVE-2026-92462 | Medium | 6.5 | 2026-09-16 | yshop-crm through 2.1.3 fails to enforce authorization checks on the CrmFlowController deleteFlowStep endpoint, allowing any authenticated back-office user to… |
CVE-2026-92459 | Medium | 6.5 | 2026-09-16 | yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmCluesController receiveCustomer endpoint that allows authenticated back-office… |
CVE-2026-111703 | Medium | 6.3 | 2026-10-16 | yshop-crm through 2.1.3 contains an insecure direct object reference vulnerability that allows authenticated sales users to access other users' customer record… |
CVE-2026-109173 | Medium | 4.3 | 2026-10-12 | yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject invoices via POST /a… |
CVE-2026-109172 | Medium | 4.3 | 2026-10-12 | yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject receivables records… |
CVE-2026-109171 | Medium | 4.3 | 2026-10-12 | yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject contracts by calling… |
CVE-2026-92455 | Medium | 4.3 | 2026-09-16 | yshop-crm through 2.1.3 fails to enforce authorization on the sendSms and sendMail endpoints in CrmCustomerController, allowing any authenticated back-office u… |