CVE-2026-92460 is a missing authorization vulnerability in yshop-crm through version 2.1.3. The affected endpoint, GET /admin-api/crm/operatelog/page, does not enforce authorization controls, enabling any authenticated back-office user to retrieve the entire audit log. This exposure includes detailed operational logs such as operator identities, client IPs, user agents, request URLs, and customer identifiers, potentially leading to information disclosure within the installation.

The vulnerability allows unauthorized access to sensitive audit log data by any authenticated back-office user. This could lead to exposure of operational details and customer information, which may aid attackers in reconnaissance or further attacks. However, there is no indication of privilege escalation or remote unauthenticated exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict back-office user permissions to only those who require access to audit logs and monitor access to the affected endpoint.