Executive brief
yshop-crm is a CRM system for sales teams that manages customer data, lead allocation, and customer recycling policies. The system fails to properly restrict access to two critical API endpoints, allowing any authenticated user to read and modify installation-wide settings that control how customers are distributed to salespeople and automatically recycled. An attacker can manipulate these settings to delete customer records in bulk, disable lead recycling, or prevent new customer creation across the entire deployment.
Technical details
The vulnerability is a broken function-level authorization (CWE-639) in the CrmCustomerController class. The saveRedisSet and getRedisSet endpoints lack @PreAuthorize annotations that guard sibling methods in the same controller, allowing any authenticated back-office user to invoke them without permission checks. These endpoints read and write three global Redis keys (customerNum, notRecordDay, notSuccessDay) that control customer holding limits and auto-recycling thresholds applied across the entire deployment. An attacker can modify these keys via POST /admin-api/crm/customer/saveRedisSet to manipulate lead allocation and trigger mass customer data deletion through the CustomerAutoJob scheduler. The attack requires only valid authentication credentials with minimal privilege; no network or user interaction preconditions beyond login.
Affected products
- yshop-crm yshop-crm through 2.1.3
Timeline
- 2026-09-16: disclosed