CVE-2026-92455: yshop-crm through 2.1.3 Missing Authorization via CRM Customer Messaging Endpoints
yshop-crm through 2.1.3 fails to enforce authorization on the sendSms and sendMail endpoints in CrmCustomerController, allowing any authenticated back-office user to send SMS and email to arbitrary customers. Attackers can invoke POST /admin-api/crm/customer/send-sms and POST /admin-api/crm/customer/send-mail with arbitrary customerIds, templateCode, and templateParams to deliver unauthorized messages through the organization's SMS and email channels.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated back-office user can exploit it. The attacker does not need elevated messaging or customer-management authorization.
What access and endpoint details are required for exploitation?
The attacker needs authenticated access to the back-office API and can send POST requests to /admin-api/crm/customer/send-sms or /admin-api/crm/customer/send-mail. Requests can specify arbitrary customerIds, templateCode, and templateParams.
What is the practical impact?
An attacker can use the organization's SMS and email channels to send unauthorized templated messages to arbitrary customers. The stated impact is unauthorized message delivery, with integrity impact rated low and no stated confidentiality or availability impact.