CVE-2026-111703: yshop-crm through 2.1.3 IDOR via CRM customer by-id endpoints
yshop-crm through 2.1.3 contains an insecure direct object reference vulnerability that allows authenticated sales users to access other users' customer records by supplying arbitrary ids. Attackers can enumerate ids against the get, update, delete and do-open endpoints to read contact details, overwrite or delete customers, or release them into the public pool.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with the sales role can exploit it. No user interaction is required, and the attack can be performed remotely by submitting arbitrary customer IDs to the affected endpoints.
What actions can an attacker perform against another user's customer record?
An attacker can use the get endpoint to read customer contact details, the update endpoint to overwrite records, the delete endpoint to remove them, and the do-open endpoint to release customers into the public pool.
Which deployments are affected?
yshop-crm versions through 2.1.3 are affected. The issue is in authorization for CRM customer by-ID operations, so deployments that expose these endpoints to authenticated sales users are at risk.