Is CVE-2026-92457 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-92457 being exploited in the wild.

How severe is CVE-2026-92457?

Medium severity, with a CVSS score of 6.5, published 16 September 2026.

Is there a fix for CVE-2026-92457?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-92457 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-92457?

Check whether you run Yshop-Crm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-92457: yshop-crm authorization bypass in invoice issuance

CVE-2026-92457 · Severity: medium · CVSS 6.5 · Published 2026-09-16

yshop-crm is a customer relationship management system used by sales teams to manage contacts, contracts, and invoices. A missing authorization check in the invoice issuance endpoint allows authenticated users without proper permissions to issue arbitrary invoices, falsify contract financial records by inflating invoiced amounts, and send fraudulent invoice emails to arbitrary recipients—potentially leading to financial fraud and customer confusion.

Technologies: Yshop-Crm. Vendors: Yshop-Crm.

Quick answers

Is CVE-2026-92457 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-92457 being exploited in the wild.
How severe is CVE-2026-92457?: Medium severity, with a CVSS score of 6.5, published 16 September 2026.
Which products and versions are affected?: Yshop-Crm through 2.1.3.
Is there a fix for CVE-2026-92457?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-92457 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-92457?: Check whether you run Yshop-Crm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a broken function-level authorization (OWASP A01) in the CrmInvoiceController.issueInvoice endpoint, which lacks @PreAuthorize annotation while other methods in the same controller are protected by crm:invoice:* permissions. An authenticated attacker with network access can send a PUT request to /admin-api/crm/invoice/issue without CRM permissions; the vulnerable service implementation does not merely flip an invoice status but also adds the invoice amount to a linked contract's invoicedMoney field, permanently corrupting financial state. If the invoice includes an attachment URL and recipient address, the attacker can also trigger email delivery to arbitrary addresses. The endpoint is reachable from any authenticated session and requires no additional preconditions.

Affected products

yshop-crm yshop-crm through 2.1.3

Timeline

2026-09-16: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.