Vulnerability · Published Sep 16, 2026 · Assigned by VulnCheck

CVE-2026-92459yshop-crm through 2.1.3 Missing Authorization via CRM Lead-Claim Endpoint

Medium 6.5

In plain English

A medium-severity missing authorization in yshop-crm from guchengwuyue. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 62.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmCluesController receiveCustomer endpoint that allows authenticated back-office users to claim sales leads without proper permission checks. Attackers can invoke the lead-claim endpoint to reassign leads from other employees to themselves by overwriting the ownerUserId field, with no access logging or quota validation to prevent bulk lead theft.

Affected products (as reported)

Vendor	Product	Versions
guchengwuyue	yshop-crm	0 – through 2.1.3

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

References

Reporter proof of concept: unauthorized lead claim via /crm/clues/receive exploit
receiveCustomer declared without @PreAuthorize while the sibling open handler requires crm:clues:query technical-description
receiveClues overwrites ownerUserId with no public-pool or ownership assertion technical-description
Maven revision property showing the affected tree is version 2.1.3 technical-description
yshop-crm source repository product
VulnCheck Advisory: yshop-crm through 2.1.3 Missing Authorization via CRM Lead-Claim Endpoint third-party-advisory