Vulnerability · Published Oct 12, 2026 · Assigned by VulnCheck

CVE-2026-109171yshop-crm through 2.1.3 Missing Authorization via /admin-api/crm/contract/check

Medium 4.3

In plain English

A medium-severity missing authorization in yshop-crm from guchengwuyue. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 90.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject contracts by calling POST /admin-api/crm/contract/check. Because CrmContractController lacks @PreAuthorize and approver checks are commented out, attackers can approve contracts to alter customer deal and purchase data or reject them to return products to stock.

Affected products (as reported)

Vendor	Product	Versions
guchengwuyue	yshop-crm	0 – through 2.1.3

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

Researcher Proof of Concept exploit
Vulnerable Code technical-description
Vulnerable Code technical-description
Permission Seed Data technical-description
VulnCheck Advisory: yshop-crm through 2.1.3 Missing Authorization via /admin-api/crm/contract/check third-party-advisory