CVE-2026-92462

yshop-crm through version 2.1.3 contains a missing authorization flaw (CWE-862) in the CrmFlowController deleteFlowStep function. Any authenticated back-office user, regardless of assigned permissions, can invoke DELETE /admin-api/crm/flow/delete-step to delete arbitrary approval workflow steps. Because those steps gate the finalization of contracts, receivables, and invoices, an attacker can weaken or disable approval controls and push records through finalization without proper review, or disrupt the approval process entirely. Any organization running a self-hosted yshop-crm instance at version 2.1.3 or earlier is affected. No public proof-of-concept exists, the flaw is not in CISA's KEV catalog, and no exploitation is currently known.

What to do: Upgrade yshop-crm to a release newer than 2.1.3 that restores the permission check on the deleteFlowStep endpoint as soon as one is published. Until then, restrict access to /admin-api/crm/flow/delete-step at the reverse proxy or gateway layer to roles that genuinely require it, and review approval workflow step configurations for unexplained deletions. Audit back-office account activity and API logs for DELETE requests to this endpoint to detect potential abuse.