Vulnerability · Published Sep 16, 2026 · Assigned by VulnCheck

CVE-2026-92460yshop-crm through 2.1.3 Missing Authorization via CRM Operation-Log Listing

Medium 6.5

In plain English

A medium-severity missing authorization in yshop-crm from guchengwuyue. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.5%top 60.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

yshop-crm through 2.1.3 fails to enforce authorization on the GET /admin-api/crm/operatelog/page endpoint, allowing any authenticated back-office user to access the installation-wide audit trail. Attackers can query the operation log to retrieve operator names, display nicknames, client IP addresses, User-Agent strings, request URLs, action details, and customer identifiers without proper permission checks.

Affected products (as reported)

Vendor	Product	Versions
guchengwuyue	yshop-crm	0 – through 2.1.3

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

Reporter proof of concept: audit-trail disclosure via /crm/operatelog/page exploit
getOperatelogPage declared without @PreAuthorize at 2.1.3 technical-description
selectPage builds twelve optional predicates, none referencing the caller technical-description
Maven revision property showing the affected tree is version 2.1.3 technical-description
yshop-crm source repository product
VulnCheck Advisory: yshop-crm through 2.1.3 Missing Authorization via CRM Operation-Log Listing third-party-advisory