CVE-2026-92458 describes a missing authorization vulnerability in yshop-crm through version 2.1.3. The vulnerability exists in the StoreProductController's onSale handler, which processes requests to the GET /admin-api/product/store-product/sale endpoint. Authenticated back-office users can sequentially invoke this endpoint with product IDs to alter the sale status of products without sufficient permission validation. This flaw enables unauthorized users with some level of back-office access to withdraw or re-enable products in the catalog arbitrarily.

An attacker with authenticated back-office access can modify product sale statuses without proper authorization. This could disrupt product availability by withdrawing entire product catalogs from sale or re-enabling products that were previously withdrawn. The impact is limited to users who already have some level of authenticated access but lack proper permission checks, potentially affecting business operations and product management integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict back-office user permissions to the minimum necessary and monitor access to the affected endpoint. Implement additional access controls or validation on the StoreProductController onSale handler if possible.