CVE-2026-92463

yshop-crm through 2.1.3 fails to enforce authorization on the GET /admin-api/system/user/page endpoint because the @PreAuthorize permission annotation is commented out (CWE-862, missing authorization). To exploit it, an attacker needs valid back-office credentials and a role assigned a data scope of ALL, but does not need the system:user:list permission that the endpoint is supposed to require. A successful attacker can retrieve the complete user directory, including login names, nicknames, departments, email addresses, mobile numbers, and last-login information — useful for follow-on phishing, credential attacks, or social engineering. Any deployment of yshop-crm at version 2.1.3 or earlier is affected. No exploitation has been reported, no public proof-of-concept is known, and the issue is not in CISA KEV; it carries a CVSS 4.0 score of 7.1 (high).

What to do: Upgrade to a release in which the @PreAuthorize permission check on /admin-api/system/user/page is restored (no fixed version is specified in the data); as an interim measure, re-enable the authorization annotation or block/limit access to the endpoint at a gateway. Review roles configured with data scope ALL and least-privilege back-office accounts, and audit access logs for unexplained calls to /admin-api/system/user/page.