CVE-2026-111703: Authorization Bypass Through User-Controlled Key in guchengwuyue yshop-crm

CVE-2026-111703 describes an authorization bypass vulnerability in guchengwuyue's yshop-crm product through version 2.1.3. Authenticated sales users can exploit insecure direct object references by enumerating arbitrary customer record IDs against multiple endpoints (get, update, delete, do-open). This enables unauthorized reading of contact details, overwriting or deleting customer records, and releasing customers into a public pool.

The vulnerability allows authenticated sales users to bypass authorization controls and access or modify other users' customer data. This can lead to unauthorized disclosure of contact details, data tampering, deletion of customer records, and unintended release of customers into a public pool, potentially impacting data confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to authenticated sales users and monitor usage of affected endpoints closely to detect abuse.