EUVD-2026-80662
GHSA-9fpf-hpfc-3v65
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-priv back-office user
-
DeliverySend PUT /admin-api/crm/invoice/issue without permission
-
ExploitBypass missing authorization check
-
ExecutionAlter invoice status and inflate contract amounts
-
ImpactTrigger fraudulent invoice emails to attacker addresses
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid but low-privileged authenticated back-office account on yshop-crm (PR:L); the attacker calls the PUT /admin-api/crm/invoice/issue (issueInvoice) endpoint, which lacks the required permission check. No user interaction, no special non-default configuration, and no elevated role are needed beyond basic back-office access - the CRM's invoice module must simply be deployed and reachable over the network. The primary limiting factor is that an attacker must already possess or obtain back-office credentials, which restricts this to malicious insiders, over-provisioned low-tier users, or attackers who have separately compromised an account. |
| Impact | This is a moderate, authenticated broken-access-control issue, not a critical pre-auth flaw. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N, base 7.1) shows a network-reachable, low-complexity attack but one that REQUIRES an existing low-privilege authenticated back-office account (PR:L), with impact limited to integrity (VI:H) - no confidentiality or availability loss. Public exploit code exists (github-poc, reported by VulnCheck), which raises practical exploitability among insiders or attackers who already hold back-office credentials, but it is NOT in CISA KEV and no EPSS score was provided, so there is no evidence of widespread automated exploitation. No SSVC decision data was supplied. The realistic picture is a privilege-escalation-within-application / horizontal-authorization bug: a legitimate low-tier user performs an action gated only for higher-privileged roles. Net: real and confirmed (POC + vendor advisory), but risk is bounded by the authentication prerequisite and the narrow deployment footprint of yshop-crm - treat as a genuine but non-emergency fix, prioritized higher wherever untrusted or numerous back-office accounts exist. |
| Exploit ScenarioDerived | A low-privileged back-office user (or an attacker who has phished/obtained such an account) sends a crafted PUT request to /admin-api/crm/invoice/issue, an endpoint that fails to check the required permission. They mark invoices as issued, inflate a contract's invoiced amount to attacker-chosen values, and dispatch invoice emails to arbitrary external addresses - enabling financial fraud or reputational abuse. A public Python PoC (LinYuanyi1/cve-request-poc) demonstrates the request, lowering the skill barrier. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Missing authorization in yshop-crm through 2.1.3 allows any authenticated back-office user to issue arbitrary invoices by calling the PUT /admin-api/crm/invoice/issue endpoint, which performs no permission check on the caller. An attacker holding low-privileged back-office credentials can set an invoice's status, overwrite contract invoiced amounts with attacker-chosen values, and trigger invoice emails to arbitrary recipient addresses - a pure integrity impact with no confidentiality or availability loss. Publicly available exploit code exists (a Python PoC in the LinYuanyi1 cve-request-poc repository), but there is no evidence of confirmed active exploitation (CISA KEV).
RemediationAI
No vendor-released patch has been identified at time of analysis, and the available references are upstream source files and a VulnCheck advisory (https://www.vulncheck.com/advisories/yshop-crm-through-2.1.3-missing-authorization-via-crminvoicecontroller-issueinvoice) rather than a fixed release, so operators should track https://github.com/guchengwuyue/yshop-crm for a patched version. Until a fix lands, the most effective compensating control is to block or restrict the vulnerable route at the perimeter: deny PUT /admin-api/crm/invoice/issue at the reverse proxy/WAF/gateway for all but the specific admin role that legitimately needs it - the trade-off is that legitimate invoice issuance must be routed through an approved internal path or the admin UI, and overly broad blocking rules can break normal invoicing workflows. Complement this with server-side RBAC hardening by adding an explicit permission annotation to the controller method if you maintain a fork, and urgently review and audit existing invoices and contract invoiced amounts for unauthorized changes. To limit blast radius, disable or tightly scope outbound invoice-email/SMTP notification behavior so attackers cannot use the endpoint to spray invoice emails to arbitrary addresses, at the cost of losing automated customer notifications. Finally, force rotation and least-privilege redesign of back-office accounts, since the primary precondition for exploitation is possession of any valid low-privileged credential - the trade-off is operational friction during credential resets, but it directly removes the prerequisite for malicious insiders and over-provisioned users. Monitor admin-api logs for unexpected PUT requests to the invoice issue endpoint as a detection backstop.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
yshop-crm is a Java/Spring Boot based CRM application (Maven-built, package namespace co.yixiang.yshop.module.crm) whose invoice workflow is exposed through CrmInvoiceController's issueInvoice handler at PUT /admin-api/crm/invoice/issue. The root cause is CWE-862 (Missing Authorization): the controller method at CrmInvoiceController.java#L80 lacks the required permission/authorization annotation, so the downstream business logic in CrmInvoiceServiceImpl.java#L317 - which mutates invoice state, writes attacker-supplied invoiced amounts onto contracts, and dispatches invoice emails - executes for any caller the framework has authenticated. The endpoint lives under the /admin-api surface but the missing check means ordinary back-office roles reach it. The framework-level authentication (a valid session/token) is enforced, which is why the assessed vector is PR:L rather than PR:N; the failure is purely at the authorization layer. The CPE cpe:2.3:a:guchengwuyue:yshop-crm:* confirms all released versions up to and including 2.1.3 are affected.
Know when Yshop Crm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Network-reachable API with low complexity but requires a valid low-privilege back-office login (PR:L); impact is integrity-only (invoice/contract data manipulation), no confidentiality or availability loss.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmInvoiceController issueInvoice endpoint that allows authenticated back-office users to issue arbitrary invoices. Attackers can call the PUT /admin-api/crm/invoice/issue endpoint without required permissions to modify invoice status, inflate contract invoiced amounts with attacker-chosen values, and trigger invoice emails to arbitrary addresses.
Technical POC Analysis
CWE-862 (Missing Authorization), specifically a function-level authorization gap.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
yshop-crm versions up to 2.1.3 contain a missing authorization flaw that allows back-office users to issue arbitrary invoices and alter contract billing amounts, posing a significant financial integrity risk to organizations relying on the platform. Because publicly available exploit code exists, the likelihood of exploitation is elevated, and leadership should prioritize immediate mitigations to prevent fraudulent invoicing and potential reputational damage.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting access to the vulnerable endpoint, enforcing additional authorization checks at the API gateway, conducting user permission audits, and monitoring logs for anomalous invoice activities.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Missing authorization in yshop-crm through 2.1.3 lets any authenticated back-office user, regardless of role or privileg
Authenticated back-office users of yshop-crm through 2.1.3 can enumerate the complete user directory via GET /admin-api/
Missing authorization in yshop-crm through 2.1.3 allows any authenticated back-office user - including low-privilege ope
Missing authorization in yshop-crm 2.1.3 and earlier lets any authenticated back-office (admin-api) user delete arbitrar
Missing authorization in yshop-crm through 2.1.3 allows any authenticated back-office user to claim and reassign sales l
Missing authorization in yshop-crm through 2.1.3 allows any authenticated back-office user to read CRM approval-workflow
Authenticated back-office users can abuse yshop-crm through 2.1.3 to send SMS and email to arbitrary customers via POST
Missing authorization in the StoreProductController onSale handler of Yshop CRM through 2.1.3 allows any authenticated b
Insecure direct object reference in yshop-crm through 2.1.3 allows an authenticated sales user to read, overwrite, delet
Exploit-DB