CVE-2026-92463: yshop-crm through 2.1.3 Missing Authorization via Disabled Annotation on System User Listing

Published Sep 16, 2026
·
Updated

yshop-crm through 2.1.3 contains an authorization failure in the GET /admin-api/system/user/page endpoint where the @PreAuthorize annotation is commented out, allowing authenticated back-office users without system:user:list permission to enumerate all users. Attackers with valid back-office credentials and a role with data scope ALL can retrieve the complete user directory including login names, nicknames, departments, email addresses, mobile numbers, and last login information.

Affected Software

1 affected component
yshop-crm<=2.1.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade yshop-crm to a version that resolves this vulnerability.

    Fixed in 2.1.3
  2. Configuration

    Re-enable the @PreAuthorize authorization annotation on the GET /admin-api/system/user/page endpoint so back-office users must have the system:user:list permission to list users.

    yshop-crm (@PreAuthorize) @PreAuthorize on GET /admin-api/system/user/page (system:user:list permission check) = enabled

Event History

Sep 16, 2026
CVE Published
via MITRE·11:07 AM
Data Sourced
via MITRE·11:07 AM
DescriptionSeverityWeakness

Frequently Asked Questions

1

Does a user need the system:user:list permission to exploit this issue?

No. An authenticated back-office user lacking system:user:list permission can access the endpoint if their role has a data scope of ALL.

2

Does exploitation require user interaction or a complex attack sequence?

No user interaction is required. The CVSS vector indicates network access, low attack complexity, and low privileges required.

3

What is the expected security impact?

The impact is disclosure of the complete user directory, including login names, nicknames, departments, email addresses, mobile numbers, and last-login information. The reported CVSS vector indicates high confidentiality impact and no integrity or availability impact.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203