Yshop CRM CVE-2026-92456

Requires a valid authenticated back-office (admin-panel) user account of any privilege level - the saveRedisSet and getRedisSet endpoints in CrmCustomerController perform no authorization/role check (CWE-862), so any logged-in staff user can invoke them. No special product configuration, feature flag, or user interaction is needed beyond having an account and network reach to the CRM's admin API. The limiting factor is PR:L: the attacker cannot exploit this fully unauthenticated, so the practical threat is a malicious insider or an attacker who has already obtained any low-privilege CRM credential. The affected Redis keys must be in use, which is the default operational path since CustomerAutoJob relies on them for auto-recycling.

This is a genuine but bounded-priority issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L) is well-calibrated for a broken-access-control flaw: network-reachable and low-complexity, but gated behind PR:L - the attacker must already hold a valid authenticated back-office account, which is the single most important limiter. Impact is integrity-dominant (VI:H - modifying installation-wide lead-allocation and auto-recycling policy) with only low availability effect (VA:L) and no confidentiality loss (VC:N), even though getRedisSet also reads config, because the exposed Redis keys are low-sensitivity operational settings rather than customer PII. A public POC exists (VulnCheck / LinYuanyi1 github-poc), which raises practical exploitability, but there is no CISA KEV listing, no EPSS score in the input, and no evidence of active exploitation - so this is 'publicly available exploit code exists', NOT confirmed in-the-wild use. Net: a real, easily-weaponized privilege-abuse bug for anyone who already has a foothold account, but not an unauthenticated internet-facing crisis. The 'Authentication Bypass' tag overstates it - PR:L confirms this is authorization-after-authentication (CWE-862), not an auth bypass.

A low-privileged but authenticated back-office user (or an attacker who has phished/obtained any staff CRM credential) sends a crafted request to the CrmCustomerController saveRedisSet endpoint, which performs no authorization check. By rewriting the shared Redis keys governing customer auto-recycling, they trigger mass customer-record deletion, disable lead recycling, or block new customer creation across the entire deployment. A working POC for this exact endpoint is publicly published, lowering the skill barrier to trivial.