Executive brief
yshop-crm is a sales CRM system used by enterprises to manage customer relationships and sales workflows. A missing permission check in the product management interface allows any authenticated back-office user—even with minimal privileges—to toggle products on and off sale, potentially hiding entire product catalogs from customers or re-enabling withdrawn products without proper approval. The vulnerability is compounded by the use of a GET request to make persistent changes, making attacks possible through simple URL fetches or CSRF vectors.
Technical details
The vulnerability is a broken function-level authorization (BFLA) flaw in StoreProductController.onSale(), which lacks @PreAuthorize annotation while other methods in the same controller (create, update, delete, list, export-excel) are guarded by shop:store-product:* permissions. The endpoint GET /admin-api/product/store-product/sale?id=<id>&type=<type> accepts sequential product IDs and toggles the product's is_show column via StoreProductServiceImpl.onSale() and StoreProductMapper.updateOnsale(). Any authenticated user can invoke this endpoint; the GET method compounds the risk by allowing state-changing operations from URL-based attack vectors (CSRF, image tags, crawlers). The attacker requires valid authentication credentials but no specific role or permission. Patches addressing the missing @PreAuthorize annotation and changing the endpoint to POST/DELETE are recommended.
Affected products
- yshop-crm yshop-crm through 2.1.3
Timeline
- 2026-09-16: disclosed: CVE-2026-92458 published
- 2026-09-16: other: PoC available on GitHub demonstrating toggle capability