CVE-2026-92458: yshop-crm through 2.1.3 Missing Authorization via StoreProductController onSale
yshop-crm through 2.1.3 contains a missing authorization vulnerability in the StoreProductController onSale handler that allows authenticated back-office users to modify product sale status. Attackers can invoke the GET /admin-api/product/store-product/sale endpoint with sequential product IDs to withdraw entire product catalogs from sale or re-enable withdrawn products without proper permission checks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
yshop-crmto a version that resolves this vulnerability.Fixed in 2.1.3
Event History
Frequently Asked Questions
Does exploitation require a victim to take any action?
No. The vulnerability has no user-interaction requirement; an authenticated back-office user can invoke the affected endpoint directly.
Can this be exploited over the network?
Yes. The affected functionality is exposed through the GET /admin-api/product/store-product/sale endpoint. Exploitation still requires an authenticated back-office account.
What security impact is indicated beyond product availability in the catalog?
The reported impact is limited to integrity: attackers can change whether products are on sale. The supplied severity data indicates no confidentiality or availability impact.