CVE-2026-92456: yshop-crm through 2.1.3 Missing Authorization via CRM Customer Rule-Configuration Endpoints
yshop-crm through 2.1.3 fails to enforce authorization on the saveRedisSet and getRedisSet endpoints in CrmCustomerController, allowing any authenticated back-office user to read and modify installation-wide lead-allocation and customer auto-recycling policy. Attackers can invoke these endpoints to manipulate shared Redis keys controlling customer auto-recycling behavior, causing mass customer data deletion, disabling lead recycling, or blocking customer creation across the deployment.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
yshop-crmto a version that resolves this vulnerability.Fixed in 2.1.3 - Configuration
Update CrmCustomerController so the saveRedisSet and getRedisSet endpoints enforce proper authorization (do not allow any authenticated back-office user to read/modify installation-wide lead-allocation and customer auto-recycling policy).
CrmCustomerController Authorization enforcement for saveRedisSet and getRedisSet endpoints = Require authorization for all back-office users before allowing access
Event History
Frequently Asked Questions
What level of access does an attacker need?
The attacker needs an authenticated back-office user account. No user interaction is required, and the attack can be performed over the network.
Which shared settings can be manipulated?
The affected endpoints can read and modify installation-wide Redis-backed settings for lead allocation and customer auto-recycling. Changes affect the deployment rather than only the attacker's own account.
What operational effects could indicate exploitation?
Potential effects include unexpected mass customer-data deletion, lead recycling being disabled, or customer creation becoming blocked across the deployment.