Vulnerability · Published Sep 16, 2026 · Assigned by VulnCheck

CVE-2026-92456yshop-crm through 2.1.3 Missing Authorization via CRM Customer Rule-Configuration Endpoints

High 7.1

In plain English

A high-severity missing authorization in yshop-crm from guchengwuyue. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.5%top 57.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

yshop-crm through 2.1.3 fails to enforce authorization on the saveRedisSet and getRedisSet endpoints in CrmCustomerController, allowing any authenticated back-office user to read and modify installation-wide lead-allocation and customer auto-recycling policy. Attackers can invoke these endpoints to manipulate shared Redis keys controlling customer auto-recycling behavior, causing mass customer data deletion, disabling lead recycling, or blocking customer creation across the deployment.

Affected products (as reported)

Vendor	Product	Versions
guchengwuyue	yshop-crm	0 – through 2.1.3

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

References

Reporter proof of concept: unauthorized policy rewrite via /crm/customer/saveRedisSet exploit
saveRedisSet declared without @PreAuthorize and writing three Redis keys at 2.1.3 technical-description
CustomerAutoJob consumes notRecordDay and notSuccessDay to recycle customers technical-description
openCustomer nulls customer ownership and deletes follow-up records technical-description
Maven revision property showing the affected tree is version 2.1.3 technical-description
yshop-crm source repository product
VulnCheck Advisory: yshop-crm through 2.1.3 Missing Authorization via CRM Customer Rule-Configuration Endpoints third-party-advisory