Executive brief
yshop-crm is a customer relationship management (CRM) system used by businesses to manage customer interactions and communications. Attackers who have authenticated access to the system's back-office—even with minimal or no permissions—can abuse two messaging endpoints to send unsolicited SMS and email messages to any customer in the organization, potentially damaging customer relationships and consuming paid communication credits without authorization.
Technical details
The vulnerability is a broken function-level authorization flaw in CrmCustomerController's sendSms and sendMail endpoints. Both endpoints lack @PreAuthorize annotations while sibling methods in the same controller are properly guarded with permission checks (crm:customer:create/update/delete). The service layer CrmCustomerServiceImpl processes caller-supplied customerIds directly without validating that the authenticated user has permission to message those customers. An attacker with valid authentication credentials (including accounts with zero CRM permissions) can invoke POST /admin-api/crm/customer/send-sms or POST /admin-api/crm/customer/send-mail with arbitrary customerIds, templateCode, and templateParams to dispatch messages through the organization's communication channels. The vulnerability affects yshop-crm through version 2.1.3, and a fix/patch availability is not explicitly stated in the advisory.
Affected products
- yshop-crm yshop-crm through 2.1.3
Timeline
- 2026-09-16: disclosed