CVE-2026-92459

yshop-crm through version 2.1.3 contains a missing authorization flaw (CWE-862) in the CrmCluesController receiveCustomer endpoint, which is used to claim sales leads. Any authenticated back-office user can invoke this endpoint without the permission check it should enforce, overwriting the ownerUserId field to reassign leads that belong to other employees to themselves. Because the endpoint performs no access logging and no quota validation, an attacker with even low-level credentials can silently siphon large volumes of leads in bulk, damaging the integrity of the sales pipeline. Any organization running yshop-crm up to and including 2.1.3 is affected. No public proof-of-concept is known and the flaw is not in CISA's KEV, so exploitation has not been confirmed in the wild.

What to do: Upgrade yshop-crm to a version patched for CVE-2026-92459 when the vendor releases one (no fixed version is specified in current disclosures); meanwhile, restrict which back-office roles can reach the CrmCluesController receiveCustomer endpoint, e.g., via a gateway or WAF rule. Audit lead records for ownerUserId changes that no legitimate user action explains, and review which low-privilege accounts hold back-office credentials that could reach the endpoint.