EUVD-2026-80668
GHSA-fxr9-cwrf-jj7v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid back-office credentials with data-scope-ALL role
-
ExploitSend GET /admin-api/system/user/page
-
ExecutionMissing @PreAuthorize check skips permission enforcement
-
ImpactEnumerate complete user directory and PII
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to already possess valid back-office (admin panel) credentials for yshop-crm and, critically, a role configured with data scope ALL - without that data-scope setting the enumeration returns nothing meaningful. The specific trigger is the GET /admin-api/system/user/page endpoint whose @PreAuthorize('system:user:list') annotation is commented out in UserController.java, so the normal permission gate is absent. Limiting factors: authentication is mandatory (PR:L), the elevated data-scope-ALL role is a further gate, impact is confined to reading user-directory data (no integrity or availability effect), and only yshop-crm versions through 2.1.3 are affected. |
| Impact | This is a broken-access-control / missing-authorization flaw (CWE-862), not a pre-auth vulnerability. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H) correctly reflects that exploitation is remote and low-complexity but requires valid back-office credentials (PR:L) and, per the description, a role whose data scope is ALL - a meaningful additional precondition that the base vector's PR:L understates. Impact is confidentiality-only (VI:N/VA:N): mass enumeration of the user directory including PII. A public POC exists (VulnCheck-reported Python exploit on GitHub), which raises practical risk, but there is no CISA KEV listing and no EPSS score in the input, so there is no evidence of active or widespread exploitation - treat this as POC-available but not confirmed in-the-wild. Net: a legitimate authenticated privilege-escalation/data-exposure issue in a niche open-source product, meaningful for operators of yshop-crm but not a broad emergency. Note the 'Authentication Bypass' tag is misleading - the attacker is already authenticated; this is an authorization (permission-check) bypass, and the 'Microsoft' tag is simply wrong for this open-source Chinese CRM. |
| Exploit ScenarioDerived | An attacker who already holds valid low-privilege yshop-crm back-office credentials (e.g., a compromised or self-registered staff account) assigned a role with data scope ALL sends a GET request to /admin-api/system/user/page. Because the @PreAuthorize permission check is commented out, the server returns the full user directory - login names, nicknames, departments, emails, mobile numbers, and last-login data - despite the account lacking the system:user:list permission. A public POC script (LinYuanyi1/cve-request-poc) automates this enumeration. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Authenticated back-office users of yshop-crm through 2.1.3 can enumerate the complete user directory via GET /admin-api/system/user/page because the endpoint's @PreAuthorize('system:user:list') gate is commented out in UserController.java. The flaw is a broken-access-control issue (CWE-862) that requires valid admin-panel credentials plus a role configured with data scope ALL; without that scope the query returns little of value, but with it an attacker can harvest login names, nicknames, departments, emails, mobile numbers, and last-login metadata. Publicly available exploit code exists (a Python enumeration PoC), and no CISA KEV entry confirms active exploitation at time of analysis. The independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, meaning authenticated remote confidentiality loss only - no integrity or availability impact.
RemediationAI
No vendor-released patch or fixed version has been identified at time of analysis, so the primary action is source-level: re-enable the commented-out @PreAuthorize("system:user:list") annotation on the getPage handler in UserController.java (line ~92 in the referenced commit) and rebuild/redeploy the yshop-module-system-biz module - the trade-off is that any internal caller or front-end flow currently relying on unannotated access will start receiving 403 responses until the permission is granted, so verify the admin UI grants system:user:list to intended roles first. As compensating controls, audit and strip data scope ALL from every role that does not strictly require organization-wide visibility (this alone neutralizes the exploit's value, since DeptDataPermissionRule then limits results to the caller's own department), and review AdminUserServiceImpl and the yshop-spring-boot-starter-biz-data-permission logic for other endpoints whose annotations may have been removed. Network-layer containment is possible by blocking or alerting on GET /admin-api/system/user/page at the reverse proxy/WAF for principals outside a trusted admin allowlist, but this is brittle because the same path serves legitimate administration and any path/parameter variation can bypass a naive rule. Finally, treat the exposed fields (login names, emails, mobile numbers) as potentially harvested and consider credential/PII exposure monitoring, and track the VulnCheck advisory (https://www.vulncheck.com/advisories/yshop-crm-through-2.1.3-missing-authorization-via-disabled-annotation-on-system-user-listing) and the upstream repository for a patched release.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
yshop-crm is a Java/Spring Boot back-office (CRM/ERP-style) application built on the Yixiang/yudao-derived framework stack, with Spring Security annotations controlling admin-API access. The affected component is the system module's UserController (yshop-module-system-biz), where the getPage handler mapped to GET /admin-api/system/user/page is annotated in the source with the permission check @PreAuthorize('system:user:list') - but that annotation is commented out, so Spring's method-level authorization interceptor never runs for the listing method. Root cause class is CWE-862 (Missing Authorization): the application relies on a declarative permission gate that has been effectively removed at the code level, leaving only the coarse authentication requirement. The companion service AdminUserServiceImpl and the framework's DeptDataPermissionRule (MyBatis-Plus data-permission interceptor) still apply row filtering based on the caller's data scope, which is why the enumeration only yields the full directory when the attacker's role is assigned data scope ALL. The result is a defense-in-depth gap: authentication and data-scope filtering remain, but permission-based function-level authorization is absent, enabling any authenticated principal holding a broadly scoped role to read sensitive PII from the user table.
Know when Yshop Crm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Remote authenticated back-office user (PR:L) with a data-scope-ALL role reaches an unprotected endpoint; confidentiality-only mass PII disclosure, no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
yshop-crm through 2.1.3 contains an authorization failure in the GET /admin-api/system/user/page endpoint where the @PreAuthorize annotation is commented out, allowing authenticated back-office users without system:user:list permission to enumerate all users. Attackers with valid back-office credentials and a role with data scope ALL can retrieve the complete user directory including login names, nicknames, departments, email addresses, mobile numbers, and last login information.
Technical POC Analysis
Broken access control, CWE-862 (missing authorization).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
yshop-crm deployments through version 2.1.3 expose their complete internal user directory - login names, emails, mobile numbers, departments, and last-login metadata - to any authenticated back-office user whose role carries data scope ALL, and publicly available exploit code exists to automate the harvest (no CISA KEV entry confirms active exploitation at time of analysis). Because the exposure needs only valid credentials rather than a system compromise, it lowers the barrier for insider misuse and fuels highly targeted phishing and social engineering against staff. The issue is confined to confidentiality loss with no integrity or availability impact, but the personal data at risk and the reputational and regulatory exposure it creates warrant management attention.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network reachability of /admin-api/* to trusted management networks or VPN; remove data scope ALL from roles that do not require it, which limits returned data to near-nothing; add rate limiting and detections for sequential user-page enumeration; enforce least privilege and MFA on admin-panel accounts; monitor and audit admin API access logs; and treat harvested user metadata as disclosed PII for privacy and notification review.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Missing authorization in yshop-crm through 2.1.3 lets any authenticated back-office user, regardless of role or privileg
Missing authorization in yshop-crm through 2.1.3 allows any authenticated back-office user - including low-privilege ope
Missing authorization in yshop-crm 2.1.3 and earlier lets any authenticated back-office (admin-api) user delete arbitrar
Missing authorization in yshop-crm through 2.1.3 allows any authenticated back-office user to claim and reassign sales l
Missing authorization in yshop-crm through 2.1.3 allows any authenticated back-office user to issue arbitrary invoices b
Missing authorization in yshop-crm through 2.1.3 allows any authenticated back-office user to read CRM approval-workflow
Authenticated back-office users can abuse yshop-crm through 2.1.3 to send SMS and email to arbitrary customers via POST
Missing authorization in the StoreProductController onSale handler of Yshop CRM through 2.1.3 allows any authenticated b
Insecure direct object reference in yshop-crm through 2.1.3 allows an authenticated sales user to read, overwrite, delet
Exploit-DB