EUVD-2026-80667
GHSA-h72m-g9jg-f5vg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain any back-office account
-
DeliverySend DELETE /admin-api/crm/flow/delete-step
-
ExploitBypass missing permission check
-
ExecutionDelete approval workflow steps
-
ImpactFinancial approvals finalized without sign-off
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated back-office (admin-api) user account of any privilege level - the flaw is that the deleteFlowStep endpoint (DELETE /admin-api/crm/flow/delete-step) omits the required permission check, so any logged-in staff user, not just workflow administrators, can invoke it. Limiting factors: the attacker must already hold back-office credentials (PR:L), the target must be yshop-crm at or below version 2.1.3, and impact is confined to integrity of approval-workflow data (deletion of contract/receivable/invoice approval steps) with no confidentiality or availability effect. No user interaction is needed. |
| Impact | This is a genuine but moderate-priority issue best understood as a missing-authorization (CWE-862) integrity flaw, not a critical takeover. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N) is well-calibrated: exploitation is network-based and low-complexity but requires an already-authenticated back-office account (PR:L), and impact is integrity-only - an attacker can delete approval workflow steps but cannot read data (VC:N) or take the system offline (VA:N). A public POC exists (LinYuanyi1/cve-request-poc), which raises practical exploitability, but there is no EPSS score, no CISA KEV listing, and no evidence of active exploitation, so this is publicly available exploit code rather than confirmed in-the-wild abuse. The PR:L gate and the niche footprint of this product are the main factors keeping real-world risk below the 7.1 headline. The 'Authentication Bypass' tag overstates the flaw - this is authorization bypass by an authenticated user, not authentication bypass - and the 'Microsoft' tag is simply wrong. |
| Exploit ScenarioDerived | A low-privilege back-office user (or an attacker who has phished/obtained any staff account) sends a crafted DELETE request to /admin-api/crm/flow/delete-step, which the CrmFlowController fails to gate behind the required permission check. They remove approval steps governing contract, receivable, and invoice finalization, letting financial documents be finalized without proper sign-off. A public Python POC (C09_crm_flow_delete_step.py) demonstrates the request. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Missing authorization in yshop-crm 2.1.3 and earlier lets any authenticated back-office (admin-api) user delete arbitrary approval-workflow steps via DELETE /admin-api/crm/flow/delete-step, bypassing the permission check that should restrict this to workflow administrators. The result is an integrity-only compromise of the approval chains that gate contract, receivable, and invoice finalization; there is no confidentiality or availability impact, and the CVE record's CVSS 4.0 score of 7.1 maps to an independent CVSS 3.1 assessment of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, i.e. a genuine but moderate-priority missing-authorization flaw rather than a critical takeover. Publicly available exploit code exists (a Python PoC against the delete-step endpoint); no CISA KEV listing or other confirmation of active in-the-wild exploitation was present in the supplied data.
RemediationAI
No vendor-released patch or fixed version is identified in the available data, so the primary action is to add the missing server-side authorization check: annotate CrmFlowController.deleteFlowStep with the same permission/role guard used for other admin-api CRM endpoints (e.g. an @PreAuthorize-style check requiring the workflow-admin permission) rather than relying on authentication alone, and then rebuild/deploy yshop-crm. Until that code change lands, apply compensating controls at the edge: block or allow-list DELETE /admin-api/crm/flow/delete-step at the reverse proxy/API gateway so only known workflow-administrator accounts (or internal admin networks) can reach it - the trade-off is that gateway rules are path-specific and will need updating if routes change, and a legitimate administrator operating from outside the allowed network would also be blocked. Additionally, restrict admin-api back-office accounts to the minimum staff who truly need them, rotate credentials of any non-workflow-admin users, and add auditing/alerting on delete-step calls plus periodic reconciliation of approval-step definitions against a trusted backup so unauthorized deletions of contract, receivable, or invoice approval chains can be detected and restored; note that logging and reconciliation are detective, not preventive, so they must accompany the authorization fix. Track the upstream repository and the VulnCheck advisory (https://www.vulncheck.com/advisories/yshop-crm-through-2.1.3-missing-authorization-via-crmflowcontroller-deleteflowstep) for a released patched version, and use the published PoC (https://github.com/LinYuanyi1/cve-request-poc/blob/master/yshop-crm/C09_crm_flow_delete_step.py) only to verify that the fix actually rejects the unprivileged request.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-862 (Missing Authorization) in a Java/Spring-based CRM: the yshop-crm application is built on the yshop framework and ships a dedicated back-office API surface under the /admin-api prefix, with the CRM workflow logic in yshop-module-crm-biz. CrmFlowController.java (roughly line 102 at the referenced commit) exposes deleteFlowStep as DELETE /admin-api/crm/flow/delete-step, and CrmFlowServiceImpl.java (roughly line 230) performs the underlying step removal; the controller lacks the permission annotation/role check that governs comparable endpoints, so the request reaches the service layer for any holder of a valid back-office session. Because approval steps deleted here drive contract, receivable, and invoice finalization, manipulation is purely a data-integrity problem (I:H, C:N/A:N) - the attacker gains no data disclosure and causes no denial of service, but can silently strip required approvals so that documents proceed to finalization without the intended sign-off.
Know when Yshop Crm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Network-reachable admin-api endpoint (AV:N/AC:L), exploitable by any authenticated low-privilege user (PR:L), integrity-only impact from deleting approval steps (I:H), no data disclosure or outage (C:N/A:N).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
yshop-crm through 2.1.3 fails to enforce authorization checks on the CrmFlowController deleteFlowStep endpoint, allowing any authenticated back-office user to delete arbitrary approval workflow steps. Attackers can invoke the DELETE /admin-api/crm/flow/delete-step endpoint without required permissions to remove approval steps that control contract, receivable, and invoice finalization processes.
Technical POC Analysis
Evidence caveat: the file supplied as "PATCHED SOURCE" (C09crmflowdeletestep.py) is not a patch diff.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
yshop-crm 2.1.3 and earlier contain an authorization gap that allows any authenticated back-office user to delete approval-workflow steps, directly weakening the integrity controls over contract, receivable, and invoice finalization. Publicly available exploit code exists, and No vendor-released patch identified at time of analysis, so the risk is not a data breach or outage but a financial-control and approval-bypass exposure. Leadership should treat this as a high-priority governance and fraud-risk issue because affected organizations rely on these workflows to enforce spending and revenue approvals.
No vendor-released patch identified at time of analysis; interim mitigations include restricting admin-api access to trusted networks, enforcing least privilege and MFA, blocking or alerting on DELETE /admin-api/crm/flow/delete-step, auditing and restoring unauthorized workflow-step changes, disabling workflow-step deletion functionality where not required, isolating yshop-crm from untrusted networks, and applying the vendor patch when released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Missing authorization in yshop-crm through 2.1.3 lets any authenticated back-office user, regardless of role or privileg
Authenticated back-office users of yshop-crm through 2.1.3 can enumerate the complete user directory via GET /admin-api/
Missing authorization in yshop-crm through 2.1.3 allows any authenticated back-office user - including low-privilege ope
Missing authorization in yshop-crm through 2.1.3 allows any authenticated back-office user to claim and reassign sales l
Missing authorization in yshop-crm through 2.1.3 allows any authenticated back-office user to issue arbitrary invoices b
Missing authorization in yshop-crm through 2.1.3 allows any authenticated back-office user to read CRM approval-workflow
Authenticated back-office users can abuse yshop-crm through 2.1.3 to send SMS and email to arbitrary customers via POST
Missing authorization in the StoreProductController onSale handler of Yshop CRM through 2.1.3 allows any authenticated b
Insecure direct object reference in yshop-crm through 2.1.3 allows an authenticated sales user to read, overwrite, delet
Exploit-DB