The vulnerability in yshop-crm (versions up to and including 2.1.3) is due to a missing authorization check on the GET /admin-api/system/user/page endpoint. Specifically, the @PreAuthorize annotation that enforces permission checks is commented out, enabling any authenticated back-office user with a role scoped to ALL data to retrieve the entire user directory. This exposes sensitive user information to unauthorized users within the system.

An attacker with valid back-office credentials but without the system:user:list permission can enumerate all users and access sensitive personal information including login names, nicknames, departments, email addresses, mobile numbers, and last login times. This could lead to privacy violations and facilitate further attacks such as social engineering or targeted phishing.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict back-office user roles to only those absolutely necessary and audit permissions to ensure no users have excessive data scope. Monitor for any suspicious access patterns to the affected endpoint.