CVE-2026-92456

yshop-crm through version 2.1.3 fails to enforce authorization (CWE-862) on the saveRedisSet and getRedisSet endpoints in CrmCustomerController, leaving installation-wide lead-allocation and customer auto-recycling settings unprotected. Any authenticated back-office user, regardless of assigned role or permissions, can invoke these network-reachable endpoints to read and overwrite the shared Redis keys that drive customer auto-recycling behavior. By manipulating those keys, an attacker can trigger mass deletion of customer data, disable lead recycling entirely, or block creation of new customers across the whole deployment. All yshop-crm deployments at version 2.1.3 or earlier that have low-privilege back-office accounts are affected. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known; the flaw carries a CVSS 4.0 score of 7.1 (high).

What to do: Upgrade to a fixed release newer than 2.1.3 as soon as the vendor publishes one, and track the project repository for the patch. As an interim mitigation, block or restrict access to the saveRedisSet and getRedisSet endpoints in CrmCustomerController at the reverse proxy or WAF, and audit shared Redis keys for unauthorized changes to recycling policy. Review back-office account lists and remove or downgrade low-privilege users who do not need CRM access.