CVE-2026-92460

yshop-crm through 2.1.3 fails to enforce authorization (CWE-862) on the GET /admin-api/crm/operatelog/page endpoint, which serves the installation-wide operation/audit log. Any user with even low-privilege authenticated access to the back-office API can call this endpoint over the network without administrator rights. By doing so, the attacker obtains operator account names, display nicknames, client IP addresses, User-Agent strings, request URLs, action details, and customer identifiers — useful intelligence for further attacks, internal recon, or targeted phishing. Any organization running a self-hosted yshop-crm instance at version 2.1.3 or earlier is affected. No public proof-of-conct has been released, the issue is not in CISA KEV, and no in-the-wild exploitation is confirmed; CVSS 4.0 scores it 7.1 (High) with high confidentiality impact.

What to do: Upgrade yshop-crm to a release newer than 2.1.3 as soon as a patched version incorporating an authorization check on the operatelog/page endpoint is available. Until then, restrict network access to the /admin-api/ surface (reverse-proxy ACL or VPN), and audit web-server logs for calls to /admin-api/crm/operatelog/page by non-administrator accounts, which would indicate abuse. Review back-office role assignments to minimize how many low-privilege users can reach admin-api endpoints.