EUVD-2026-80666
GHSA-gw83-68wp-9529
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege back-office login
-
DeliverySend GET /admin-api/crm/flow/flow-users
-
ExploitMissing authorization check returns full dataset
-
ExecutionHarvest approval topology and approver PII
-
ImpactUse for phishing and internal recon
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated back-office (admin panel) session of any privilege level - the endpoint enforces authentication but omits an authorization/role check, so any logged-in user can call GET /admin-api/crm/flow/flow-users regardless of their assigned role. No user interaction, no special configuration, and no elevated privileges are needed beyond holding one working low-privilege account. The limiting factor is precisely that gated account requirement (PR:L): a fully external, unauthenticated attacker cannot reach the data without first obtaining or compromising back-office credentials. |
| Impact | This is a genuine but modest-severity issue that should be prioritized as moderate, not critical. The CVSS 4.0 base score is 5.3 with vector AV:N/AC:L/PR:L/UI:N and confidentiality-only impact (VC:L, VI:N, VA:N), meaning it is network-reachable and easy to trigger but requires an authenticated back-office account (PR:L) and only leaks limited data. Public exploit code exists (VulnCheck advisory plus a GitHub PoC), which raises real-world likelihood, but there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active or widespread exploitation - the PoC signal indicates opportunistic/targeted testing potential rather than confirmed campaigns. Note a labeling conflict: the CWE is CWE-862 (Missing Authorization) and the description describes a horizontal/privilege-scope authorization gap for already-logged-in users, yet the input Tags include 'Authentication Bypass' - this is misleading because authentication is NOT bypassed; a valid session is required. Net: real, PoC-backed, but bounded by authentication and low technical impact. |
| Exploit ScenarioDerived | An attacker who already holds any low-privilege back-office account (e.g., a junior sales or support operator, or a compromised employee login) sends a single GET request to /admin-api/crm/flow/flow-users and receives the full approval-chain topology plus approver PII. Because a public Python PoC (C08_crm_flow_users.py) is available, exploitation requires no custom tooling. The harvested login names, emails, mobile numbers, departments and last-login IPs are then reused for targeted phishing, social engineering of approvers, or internal reconnaissance to map who signs off on transactions. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Missing authorization in yshop-crm through 2.1.3 allows any authenticated back-office user to read CRM approval-workflow data through GET /admin-api/crm/flow/flow-users, disclosing approval chain topology, step ordering, approver identifiers, and personal information such as login names, nicknames, departments, email addresses, mobile numbers, and last-login IP addresses. The endpoint does enforce authentication but omits any role or permission check, so a single low-privilege admin-panel account is sufficient - no elevated privileges, user interaction, or special configuration are required. Publicly available exploit code exists for this issue, although the CVE is not listed in CISA KEV; the practical barrier to exploitation is the requirement to hold or obtain a valid back-office session.
RemediationAI
No vendor-released patch was identified in the available intelligence at time of analysis, so operators should not assume an upstream fix exists for versions through 2.1.3 - check the yshop-crm project at https://github.com/guchengwuyue/yshop-crm and the VulnCheck advisory at https://www.vulncheck.com/advisories/yshop-crm-through-2.1.3-missing-authorization-via-crm-approval-chain-endpoint for a later release before upgrading. Until a fix is available, the most direct compensating control is to add an explicit authorization check on GET /admin-api/crm/flow/flow-users at the application layer (for example a role or permission annotation on the corresponding handler/service method restricting the call to CRM workflow administrators), which requires a code change and a rebuild of the yshop-module-crm-biz module but removes the exposure entirely. If code changes cannot be made quickly, block or restrict the /admin-api/crm/flow/flow-users path at the reverse proxy, API gateway, or WAF so that only trusted internal networks or specific administrative accounts can reach it - this is fast and reversible, but it will break any legitimate UI feature that depends on the endpoint and must be paired with continued authentication enforcement so the route is not left open. Additional hardening with low operational cost: audit all back-office accounts and revoke or downgrade unused ones to shrink the pool of credentials that can reach the endpoint, enforce strong authentication and MFA on the admin panel, and review server and application logs for anomalous calls to /admin-api/crm/flow/flow-users. The leaked fields (employee emails, mobile numbers, and last-login IPs) should be treated as compromised for notification and anti-phishing purposes, since remediation of the code flaw does not undo the disclosure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
yshop-crm is an open-source Java/Spring Boot CRM built by guchengwuyue as a multi-module Maven project (the affected code lives in yshop-module-crm-biz), and it exposes a set of /admin-api/crm/... REST endpoints consumed by the back-office front end. The flaw is CWE-862 (Missing Authorization): the flow-users handler in CrmFlowController.java (referenced at line 94) delegates to CrmFlowServiceImpl.java (line 132) and returns the workflow participant collection without evaluating whether the calling principal is entitled to it, meaning whatever authentication filter protects /admin-api/ allows the request through but no role- or permission-level guard restricts the handler method. As a result the read is limited only by the caller holding a valid session, not by their assigned role. The CPE cpe:2.3:a:guchengwuyue:yshop-crm:*:*:*:*:*:*:*:* uses a wildcard version, so every release up to and including 2.1.3 is treated as affected. Because the leaked fields include approver identifiers, chain ordering, email addresses, phone numbers, and last-login IPs, the data set is useful for mapping internal approval processes and for follow-on social engineering or credential-targeting against named staff.
Know when Yshop Crm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Authenticated low-priv user (PR:L) makes an easy network request (AV:N/AC:L) that leaks limited PII/workflow data only, so C:L with I:N/A:N.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
yshop-crm through 2.1.3 contains a missing authorization vulnerability in the GET /admin-api/crm/flow/flow-users endpoint that allows any logged-in back-office user to access approval workflow data. Attackers can retrieve approval chain topology, step ordering, approver identifiers, and personal information including login names, nicknames, departments, email addresses, mobile numbers and last login IP addresses.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Missing authorization in yshop-crm through 2.1.3 lets any authenticated back-office user, regardless of role or privileg
Authenticated back-office users of yshop-crm through 2.1.3 can enumerate the complete user directory via GET /admin-api/
Missing authorization in yshop-crm through 2.1.3 allows any authenticated back-office user - including low-privilege ope
Missing authorization in yshop-crm 2.1.3 and earlier lets any authenticated back-office (admin-api) user delete arbitrar
Missing authorization in yshop-crm through 2.1.3 allows any authenticated back-office user to claim and reassign sales l
Missing authorization in yshop-crm through 2.1.3 allows any authenticated back-office user to issue arbitrary invoices b
Authenticated back-office users can abuse yshop-crm through 2.1.3 to send SMS and email to arbitrary customers via POST
Missing authorization in the StoreProductController onSale handler of Yshop CRM through 2.1.3 allows any authenticated b
Insecure direct object reference in yshop-crm through 2.1.3 allows an authenticated sales user to read, overwrite, delet
Exploit-DB