CVE-2026-92457

yshop-crm through 2.1.3 fails to enforce a permission check on the CrmInvoiceController issueInvoice endpoint, a classic CWE-862 missing authorization flaw. Any authenticated back-office user, regardless of assigned role, can call PUT /admin-api/crm/invoice/issue and perform invoice issuance actions that should require elevated permissions. By exploiting this, an attacker can modify invoice status, inflate contract invoiced amounts with arbitrary attacker-chosen values, and trigger invoice emails to arbitrary addresses, enabling financial-record manipulation and possible fraud or phishing via spoofed invoice emails. All deployments of yshop-crm up to and including version 2.1.3 are affected. No public proof-of-concept or confirmed in-the-wild exploitation is known at this time.

What to do: Upgrade yshop-crm to a release newer than 2.1.3 as soon as a patched version is available. As interim mitigation, restrict access to the /admin-api/crm/invoice/issue endpoint (e.g., via a gateway or WAF rule) and audit back-office accounts for over-broad access. Review existing invoice records and contract invoiced amounts for tampering and check email logs for unexpected invoice issuances or messages sent to unknown addresses.