Executive brief
yshop-crm is a customer relationship management system used by sales teams to manage contacts, contracts, and invoices. A missing authorization check in the invoice issuance endpoint allows authenticated users without proper permissions to issue arbitrary invoices, falsify contract financial records by inflating invoiced amounts, and send fraudulent invoice emails to arbitrary recipients—potentially leading to financial fraud and customer confusion.
Technical details
The vulnerability is a broken function-level authorization (OWASP A01) in the CrmInvoiceController.issueInvoice endpoint, which lacks @PreAuthorize annotation while other methods in the same controller are protected by crm:invoice:* permissions. An authenticated attacker with network access can send a PUT request to /admin-api/crm/invoice/issue without CRM permissions; the vulnerable service implementation does not merely flip an invoice status but also adds the invoice amount to a linked contract's invoicedMoney field, permanently corrupting financial state. If the invoice includes an attachment URL and recipient address, the attacker can also trigger email delivery to arbitrary addresses. The endpoint is reachable from any authenticated session and requires no additional preconditions.
Affected products
- yshop-crm yshop-crm through 2.1.3
Timeline
- 2026-09-16: disclosed