CVE-2026-92459: yshop-crm through 2.1.3 Missing Authorization via CRM Lead-Claim Endpoint
yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmCluesController receiveCustomer endpoint that allows authenticated back-office users to claim sales leads without proper permission checks. Attackers can invoke the lead-claim endpoint to reassign leads from other employees to themselves by overwriting the ownerUserId field, with no access logging or quota validation to prevent bulk lead theft.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated back-office user can exploit it. The issue affects deployments of yshop-crm through version 2.1.3 that expose the CRM lead-claim functionality to such users.
What does an attacker need to do to take another employee's lead?
The attacker needs to invoke the CrmCluesController receiveCustomer lead-claim endpoint and overwrite the ownerUserId field. No additional permission check is enforced for claiming leads owned by other employees.
What is the likely operational impact?
An attacker can reassign sales leads from other employees to themselves, affecting lead ownership and sales workflow integrity. The endpoint has no access logging or quota validation described, enabling bulk reassignment without those controls.