Vulnerability · Published Sep 16, 2026 · Assigned by VulnCheck

CVE-2026-92455yshop-crm through 2.1.3 Missing Authorization via CRM Customer Messaging Endpoints

Medium 4.3

In plain English

A medium-severity missing authorization in yshop-crm from guchengwuyue. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.4%top 69.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

yshop-crm through 2.1.3 fails to enforce authorization on the sendSms and sendMail endpoints in CrmCustomerController, allowing any authenticated back-office user to send SMS and email to arbitrary customers. Attackers can invoke POST /admin-api/crm/customer/send-sms and POST /admin-api/crm/customer/send-mail with arbitrary customerIds, templateCode, and templateParams to deliver unauthorized messages through the organization's SMS and email channels.

Affected products (as reported)

Vendor	Product	Versions
guchengwuyue	yshop-crm	0 – through 2.1.3

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

Reporter proof of concept: unauthorized SMS dispatch via /crm/customer/send-sms exploit
Reporter proof of concept: unauthorized mail dispatch via /crm/customer/send-mail exploit
sendSms and sendMail declared without @PreAuthorize at 2.1.3 technical-description
sendSms resolves recipients from caller-supplied customerIds with no scope predicate technical-description
Maven revision property showing the affected tree is version 2.1.3 technical-description
yshop-crm source repository product
VulnCheck Advisory: yshop-crm through 2.1.3 Missing Authorization via CRM Customer Messaging Endpoints third-party-advisory