CVE-2026-92462: yshop-crm through 2.1.3 Missing Authorization via CrmFlowController deleteFlowStep
yshop-crm through 2.1.3 fails to enforce authorization checks on the CrmFlowController deleteFlowStep endpoint, allowing any authenticated back-office user to delete arbitrary approval workflow steps. Attackers can invoke the DELETE /admin-api/crm/flow/delete-step endpoint without required permissions to remove approval steps that control contract, receivable, and invoice finalization processes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
yshop-crmto a version that resolves this vulnerability.Fixed in 2.1.3 - Compensating control
Restrict access to the DELETE /admin-api/crm/flow/delete-step endpoint to only authorized back-office users (e.g., enforce authorization at the API layer or restrict via an upstream control such as WAF/ACL) so authenticated users cannot delete approval workflow steps without required permissions.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated back-office user can exploit it. The vulnerable endpoint does not require the permissions normally needed to delete approval workflow steps.
What access does an attacker need?
The attacker needs valid authentication as a back-office user and network access to the administrative API. No user interaction is required.
What business processes can be affected?
An attacker can delete arbitrary workflow steps used to control contract, receivable, and invoice finalization processes. This can undermine approval controls for those processes.
How can I determine whether the endpoint is exposed to unauthorized deletion?
Review access controls for DELETE /admin-api/crm/flow/delete-step. If an authenticated back-office account without the expected workflow-management permissions can delete a flow step, the instance is affected.