Is CVE-2026-92455 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-92455 being exploited in the wild.

How severe is CVE-2026-92455?

Medium severity, with a CVSS score of 4.3, published 16 September 2026.

Is there a fix for CVE-2026-92455?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-92455 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-92455?

Check whether you run Yshop-Crm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-92455: yshop-crm authorization bypass in sendSms and sendMail

CVE-2026-92455 · Severity: medium · CVSS 4.3 · Published 2026-09-16

yshop-crm is a customer relationship management (CRM) system used by businesses to manage customer interactions and communications. Attackers who have authenticated access to the system's back-office—even with minimal or no permissions—can abuse two messaging endpoints to send unsolicited SMS and email messages to any customer in the organization, potentially damaging customer relationships and consuming paid communication credits without authorization.

Technologies: Yshop-Crm. Vendors: Yshop-Crm.

Quick answers

Is CVE-2026-92455 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-92455 being exploited in the wild.
How severe is CVE-2026-92455?: Medium severity, with a CVSS score of 4.3, published 16 September 2026.
Which products and versions are affected?: Yshop-Crm through 2.1.3.
Is there a fix for CVE-2026-92455?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-92455 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-92455?: Check whether you run Yshop-Crm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a broken function-level authorization flaw in CrmCustomerController's sendSms and sendMail endpoints. Both endpoints lack @PreAuthorize annotations while sibling methods in the same controller are properly guarded with permission checks (crm:customer:create/update/delete). The service layer CrmCustomerServiceImpl processes caller-supplied customerIds directly without validating that the authenticated user has permission to message those customers. An attacker with valid authentication credentials (including accounts with zero CRM permissions) can invoke POST /admin-api/crm/customer/send-sms or POST /admin-api/crm/customer/send-mail with arbitrary customerIds, templateCode, and templateParams to dispatch messages through the organization's communication channels. The vulnerability affects yshop-crm through version 2.1.3, and a fix/patch availability is not explicitly stated in the advisory.

Affected products

yshop-crm yshop-crm through 2.1.3

Timeline

2026-09-16: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.