yshop-crm CVE-2026-92455

Requires a valid authenticated back-office account on yshop-crm ≤2.1.3 (PR:L) - the CrmCustomerController sendSms/sendMail endpoints perform no per-object authorization check, so any authenticated role can invoke them regardless of intended privilege. Exploitation is remote over HTTP with no user interaction and no special product configuration; the organization must have functional SMS and email channels configured for the messages to actually be delivered. The limiting factor is the authentication requirement: this is not exploitable pre-auth against default installs, so realistic risk centers on malicious insiders or attackers who have already obtained CRM credentials.

This is a genuine but low-to-moderate priority issue. The vendor CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N) confirms remote, low-complexity exploitation but requires an authenticated back-office account (PR:L), which materially limits the attacker population to insiders or actors who have already compromised a valid CRM login. Impact is correctly scoped to integrity-low only (VI:L) - the flaw abuses the organization's SMS/email channels to deliver unauthorized messages; there is no confidentiality loss (VC:N) or availability impact (VA:N), so the 5.3 score is well-calibrated and not an inflated high-CVSS-low-real-risk case. A public POC exists (VulnCheck-reported, two exploit scripts published by LinYuanyi1), which raises practical exploitability, but there is no CISA KEV listing and no EPSS score provided, so there is no evidence of active exploitation. No SSVC decision data was supplied. The realistic risk is targeted insider/post-compromise abuse (spam, phishing via trusted channels, quota/cost exhaustion, reputational harm) rather than mass remote exploitation. One tag conflict to note: the input labels this 'Authentication Bypass', but the CWE-862 missing-authorization nature plus PR:L means it is an authorization (access-control) flaw for an already-authenticated user, not an authentication bypass.

An authenticated low-privilege back-office user (or an attacker who has phished/stolen any valid CRM login) sends POST /admin-api/crm/customer/send-sms and /send-mail with arbitrary customerIds, templateCode, and templateParams. This delivers attacker-controlled SMS and email to any customers through the organization's trusted messaging channels, enabling phishing, spam, or SMS/email cost exhaustion. Public POC scripts (C01_crm_customer_send_sms.py and C02_crm_customer_send_mail.py) automate the requests.