CVE-2026-92459: Missing Authorization in guchengwuyue yshop-crm
yshop-crm versions up to 2.1.3 have a missing authorization vulnerability in the CrmCluesController receiveCustomer endpoint. Authenticated back-office users can claim sales leads without proper permission checks, allowing them to reassign leads from other employees to themselves. There is no access logging or quota validation to prevent bulk lead theft.
AI Analysis
Technical Summary
CVE-2026-92459 describes a missing authorization vulnerability in yshop-crm through version 2.1.3. The flaw exists in the CrmCluesController receiveCustomer endpoint, which allows authenticated back-office users to invoke the lead-claim functionality without proper permission validation. This enables attackers to overwrite the ownerUserId field of sales leads, effectively reassigning leads from other employees to themselves. The vulnerability lacks access logging and quota validation, increasing the risk of bulk lead theft.
Potential Impact
An attacker with authenticated back-office access can reassign sales leads from other employees to themselves without authorization checks. This can lead to unauthorized data manipulation and potential business impact due to misappropriation of sales leads. There is no logging or quota enforcement to detect or limit abuse, increasing the risk of large-scale lead theft.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict back-office user permissions to trusted personnel only and monitor for unusual lead reassignment activity where possible.
CVE-2026-92459: Missing Authorization in guchengwuyue yshop-crm
Description
yshop-crm versions up to 2.1.3 have a missing authorization vulnerability in the CrmCluesController receiveCustomer endpoint. Authenticated back-office users can claim sales leads without proper permission checks, allowing them to reassign leads from other employees to themselves. There is no access logging or quota validation to prevent bulk lead theft.
CVSS v4.0
Score 7.1high
Affected software
guchengwuyue
yshop-crm
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-92459 describes a missing authorization vulnerability in yshop-crm through version 2.1.3. The flaw exists in the CrmCluesController receiveCustomer endpoint, which allows authenticated back-office users to invoke the lead-claim functionality without proper permission validation. This enables attackers to overwrite the ownerUserId field of sales leads, effectively reassigning leads from other employees to themselves. The vulnerability lacks access logging and quota validation, increasing the risk of bulk lead theft.
Potential Impact
An attacker with authenticated back-office access can reassign sales leads from other employees to themselves without authorization checks. This can lead to unauthorized data manipulation and potential business impact due to misappropriation of sales leads. There is no logging or quota enforcement to detect or limit abuse, increasing the risk of large-scale lead theft.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict back-office user permissions to trusted personnel only and monitor for unusual lead reassignment activity where possible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-16T10:57:06.137Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aaa7e3755bf5e2cf5884ad8
Added to database: 09/16/2026, 11:32:07 UTC
Last enriched: 09/16/2026, 11:46:38 UTC
Last updated: 09/16/2026, 12:16:13 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.