CVE-2026-92457: yshop-crm through 2.1.3 Missing Authorization via CrmInvoiceController issueInvoice
yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmInvoiceController issueInvoice endpoint that allows authenticated back-office users to issue arbitrary invoices. Attackers can call the PUT /admin-api/crm/invoice/issue endpoint without required permissions to modify invoice status, inflate contract invoiced amounts with attacker-chosen values, and trigger invoice emails to arbitrary addresses.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated back-office user can exploit the affected endpoint because the required permission check is missing. No user interaction is required.
What access and request are needed to exploit it?
An attacker needs valid back-office authentication and network access to the admin API. They can send a PUT request to /admin-api/crm/invoice/issue without the permissions normally required to issue invoices.
What is the practical impact of successful exploitation?
An attacker can change invoice status, increase contract invoiced amounts using attacker-chosen values, and cause invoice emails to be sent to arbitrary addresses.
How can defenders identify possible exploitation?
Review requests to PUT /admin-api/crm/invoice/issue and correlate them with the authenticated back-office accounts that made them. Investigate invoice status changes, unexpected increases in contract invoiced amounts, and invoice emails sent to unusual recipient addresses.