CVE-2026-92463: yshop-crm through 2.1.3 Missing Authorization via Disabled Annotation on System User Listing
yshop-crm through 2.1.3 contains an authorization failure in the GET /admin-api/system/user/page endpoint where the @PreAuthorize annotation is commented out, allowing authenticated back-office users without system:user:list permission to enumerate all users. Attackers with valid back-office credentials and a role with data scope ALL can retrieve the complete user directory including login names, nicknames, departments, email addresses, mobile numbers, and last login information.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
yshop-crmto a version that resolves this vulnerability.Fixed in 2.1.3 - Configuration
Re-enable the @PreAuthorize authorization annotation on the GET /admin-api/system/user/page endpoint so back-office users must have the system:user:list permission to list users.
yshop-crm (@PreAuthorize) @PreAuthorize on GET /admin-api/system/user/page (system:user:list permission check) = enabled
Event History
Frequently Asked Questions
Does a user need the system:user:list permission to exploit this issue?
No. An authenticated back-office user lacking system:user:list permission can access the endpoint if their role has a data scope of ALL.
Does exploitation require user interaction or a complex attack sequence?
No user interaction is required. The CVSS vector indicates network access, low attack complexity, and low privileges required.
What is the expected security impact?
The impact is disclosure of the complete user directory, including login names, nicknames, departments, email addresses, mobile numbers, and last-login information. The reported CVSS vector indicates high confidentiality impact and no integrity or availability impact.