Threats affecting pkg:github/yshop-crm

yshop-crm versions up to 2.1.3 contain an insecure direct object reference vulnerability that allows authenticated sales users to access, modify, or delete other users' customer records by supplying arbitrary IDs. This affects the get, update, delete, and do-open endpoints, enabling unauthorized enumeration and manipulation of customer data.

yshop-crm versions up to 2.1.3 have a missing authorization vulnerability in the invoice approval API endpoint. Authenticated back-office users can approve or reject invoices without proper authorization checks due to missing @PreAuthorize annotations and commented-out approver validations. This allows bypassing the intended invoice approval workflow.

yshop-crm versions up to 2.1.3 have a missing authorization vulnerability in the back-office API endpoint POST /admin-api/crm/contract-receivables/check. This flaw allows any authenticated back-office user to approve or reject receivables records without proper permission checks, enabling unauthorized approval actions and forgery of approval logs.

yshop-crm versions up to 2.1.3 have a missing authorization vulnerability in the contract approval API endpoint. Authenticated back-office users can approve or reject contracts without proper authorization checks, potentially altering customer deal and purchase data or returning products to stock.

yshop-crm through 2.1.3 contains an authorization failure in the GET /admin-api/system/user/page endpoint where the @PreAuthorize annotation is commented out, allowing authenticated back-office users without system:user:list permission to enumerate all users. Attackers with valid back-office credentials and a role with data scope ALL can retrieve the complete user directory including login names, nicknames, departments, email addresses, mobile numbers, and last login information.

yshop-crm through 2.1.3 fails to enforce authorization checks on the CrmFlowController deleteFlowStep endpoint, allowing any authenticated back-office user to delete arbitrary approval workflow steps. Attackers can invoke the DELETE /admin-api/crm/flow/delete-step endpoint without required permissions to remove approval steps that control contract, receivable, and invoice finalization processes.

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the GET /admin-api/crm/flow/flow-users endpoint that allows any logged-in back-office user to access approval workflow data. Attackers can retrieve approval chain topology, step ordering, approver identifiers, and personal information including login names, nicknames, departments, email addresses, mobile numbers and last login IP addresses.

yshop-crm versions up to 2.1.3 have a missing authorization vulnerability on the GET /admin-api/crm/operatelog/page endpoint. This flaw allows any authenticated back-office user to access the entire installation's audit logs without proper permission checks, exposing sensitive operational data such as operator names, IP addresses, User-Agent strings, request URLs, action details, and customer identifiers.

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmCluesController receiveCustomer endpoint that allows authenticated back-office users to claim sales leads without proper permission checks. Attackers can invoke the lead-claim endpoint to reassign leads from other employees to themselves by overwriting the ownerUserId field, with no access logging or quota validation to prevent bulk lead theft.

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the StoreProductController onSale handler that allows authenticated back-office users to modify product sale status. Attackers can invoke the GET /admin-api/product/store-product/sale endpoint with sequential product IDs to withdraw entire product catalogs from sale or re-enable withdrawn products without proper permission checks.

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmInvoiceController issueInvoice endpoint that allows authenticated back-office users to issue arbitrary invoices. Attackers can call the PUT /admin-api/crm/invoice/issue endpoint without required permissions to modify invoice status, inflate contract invoiced amounts with attacker-chosen values, and trigger invoice emails to arbitrary addresses.

yshop-crm through 2.1.3 fails to enforce authorization on the saveRedisSet and getRedisSet endpoints in CrmCustomerController, allowing any authenticated back-office user to read and modify installation-wide lead-allocation and customer auto-recycling policy. Attackers can invoke these endpoints to manipulate shared Redis keys controlling customer auto-recycling behavior, causing mass customer data deletion, disabling lead recycling, or blocking customer creation across the deployment.

yshop-crm versions up to 2.1.3 have a missing authorization vulnerability in the sendSms and sendMail endpoints of the CrmCustomerController. This flaw allows any authenticated back-office user to send SMS and email messages to arbitrary customers without proper permission checks. The vulnerability enables unauthorized use of the organization's messaging channels.