CVE-2026-92462: Missing Authorization in guchengwuyue yshop-crm
CVE-2026-92462 is a high-severity vulnerability in yshop-crm up to version 2.1.3 where authorization checks are missing on the deleteFlowStep endpoint. This flaw allows any authenticated back-office user to delete approval workflow steps without proper permissions. These approval steps control critical processes such as contract, receivable, and invoice finalization, potentially disrupting business operations.
AI Analysis
Technical Summary
The yshop-crm product by guchengwuyue through version 2.1.3 contains a missing authorization vulnerability in the CrmFlowController's deleteFlowStep endpoint. Authenticated back-office users can invoke the DELETE /admin-api/crm/flow/delete-step endpoint without required permissions, enabling them to remove arbitrary approval workflow steps. These steps are integral to controlling contract, receivable, and invoice finalization workflows, and their unauthorized deletion could impact business process integrity.
Potential Impact
An attacker with authenticated back-office access can delete approval workflow steps that govern contract, receivable, and invoice finalization processes. This could lead to unauthorized bypass or disruption of critical business workflows, potentially causing financial or operational impact. However, there is no indication of remote unauthenticated exploitation or privilege escalation beyond the authenticated user level.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict back-office user permissions to the minimum necessary and monitor usage of the DELETE /admin-api/crm/flow/delete-step endpoint to detect unauthorized attempts.
CVE-2026-92462: Missing Authorization in guchengwuyue yshop-crm
Description
CVE-2026-92462 is a high-severity vulnerability in yshop-crm up to version 2.1.3 where authorization checks are missing on the deleteFlowStep endpoint. This flaw allows any authenticated back-office user to delete approval workflow steps without proper permissions. These approval steps control critical processes such as contract, receivable, and invoice finalization, potentially disrupting business operations.
CVSS v4.0
Score 7.1high
Affected software
guchengwuyue
yshop-crm
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The yshop-crm product by guchengwuyue through version 2.1.3 contains a missing authorization vulnerability in the CrmFlowController's deleteFlowStep endpoint. Authenticated back-office users can invoke the DELETE /admin-api/crm/flow/delete-step endpoint without required permissions, enabling them to remove arbitrary approval workflow steps. These steps are integral to controlling contract, receivable, and invoice finalization workflows, and their unauthorized deletion could impact business process integrity.
Potential Impact
An attacker with authenticated back-office access can delete approval workflow steps that govern contract, receivable, and invoice finalization processes. This could lead to unauthorized bypass or disruption of critical business workflows, potentially causing financial or operational impact. However, there is no indication of remote unauthenticated exploitation or privilege escalation beyond the authenticated user level.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict back-office user permissions to the minimum necessary and monitor usage of the DELETE /admin-api/crm/flow/delete-step endpoint to detect unauthorized attempts.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-16T10:57:07.192Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aaa7e3755bf5e2cf5884adc
Added to database: 09/16/2026, 11:32:07 UTC
Last enriched: 09/16/2026, 11:46:31 UTC
Last updated: 09/16/2026, 12:13:25 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.