CVE-2026-109172: Missing Authorization in guchengwuyue yshop-crm
Description
yshop-crm versions up to 2.1.3 have a missing authorization vulnerability that allows any authenticated back-office user to approve or reject receivables records without proper permission checks. This occurs because the API endpoint POST /admin-api/crm/contract-receivables/check lacks a @PreAuthorize annotation, and the internal approval checks are commented out. Exploiting this flaw enables unauthorized users to manipulate contract return money values and forge approval logs.
CVSS v4.0
Score 5.3medium
Affected software
guchengwuyue
yshop-crm
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-109172 is a missing authorization vulnerability in yshop-crm through version 2.1.3. The vulnerability exists in the POST /admin-api/crm/contract-receivables/check endpoint, which does not enforce authorization controls via @PreAuthorize. Additionally, the service layer method CrmContractReceivablesServiceImpl.check has its approval checks commented out. As a result, any authenticated back-office user can approve or reject receivable records by ID, potentially inflating contract return_money and forging approval logs.
Potential Impact
An attacker with authenticated back-office access can approve or reject receivable records without proper authorization, leading to unauthorized financial data manipulation such as inflating contract return_money values and forging approval logs. This could impact financial integrity and audit trails within the application.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict back-office user permissions to trusted personnel only and monitor for suspicious approval activities. Implement additional access controls or custom authorization checks on the affected endpoint if possible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-12T12:41:57.566Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6accde4d2cdf04f65696c0a4
Added to database: 10/12/2026, 13:19:09 UTC
Last enriched: 10/12/2026, 13:34:21 UTC
Last updated: 10/12/2026, 21:47:25 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.