CVE-2026-92456: guchengwuyue yshop-crm, заобикаляне на вход и права

Описание

Оригинално описание

yshop-crm through 2.1.3 fails to enforce authorization on the saveRedisSet and getRedisSet endpoints in CrmCustomerController, allowing any authenticated back-office user to read and modify installation-wide lead-allocation and customer auto-recycling policy. Attackers can invoke these endpoints to manipulate shared Redis keys controlling customer auto-recycling behavior, causing mass customer data deletion, disabling lead recycling, or blocking customer creation across the deployment.

Засегнати продукти

• guchengwuyue yshop-crm: до 2.1.3

Вид слабост

• CWE-862 Missing Authorization

История

Други уязвимости в guchengwuyue yshop-crm

• 6.3CVE-2026-111703
• 5.3CVE-2026-109172
• 5.3CVE-2026-109173
• 5.3CVE-2026-109171
• 7.1CVE-2026-92463

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-92456
• https://nvd.nist.gov/vuln/detail/CVE-2026-92456
• https://github.com/LinYuanyi1/cve-request-poc/blob/master/yshop-crm/C04_crm_customer_save_redis_set.py
• https://github.com/guchengwuyue/yshop-crm/blob/5f5810a0e1e4ab0828523ec299bf973c2f9065d7/yshop-crm/yshop-module-crm/yshop-module-crm-biz/src/main/java/co/yixiang/yshop/module/crm/controller/admin/crmcustomer/CrmCustomerController.java#L136
• https://github.com/guchengwuyue/yshop-crm/blob/5f5810a0e1e4ab0828523ec299bf973c2f9065d7/yshop-crm/yshop-module-crm/yshop-module-crm-biz/src/main/java/co/yixiang/yshop/module/crm/job/CustomerAutoJob.java#L34
• https://github.com/guchengwuyue/yshop-crm/blob/5f5810a0e1e4ab0828523ec299bf973c2f9065d7/yshop-crm/yshop-module-crm/yshop-module-crm-biz/src/main/java/co/yixiang/yshop/module/crm/service/crmcustomer/CrmCustomerServiceImpl.java#L160
• https://github.com/guchengwuyue/yshop-crm/blob/5f5810a0e1e4ab0828523ec299bf973c2f9065d7/yshop-crm/pom.xml#L30
• https://github.com/guchengwuyue/yshop-crm
• https://www.vulncheck.com/advisories/yshop-crm-through-2.1.3-missing-authorization-via-crm-customer-rule-configuration-endpoints