Executive brief
yshop-crm is a CRM system designed for sales team lead and customer management. The receiveCustomer API endpoint lacks proper authorization checks, allowing authenticated users to steal sales leads by reassigning them to themselves without permission. This undermines sales team productivity and data integrity, as attackers can claim leads they shouldn't have access to and reset important follow-up tracking timestamps.
Technical details
The vulnerability is a broken object-level authorization (IDOR) flaw in the CrmCluesController#receiveCustomer endpoint, which lacks @PreAuthorize annotation despite siblings being guarded by crm:clues:* permission strings. The vulnerable CrmCluesServiceImpl#receiveClues method looks up a lead by ID and unconditionally overwrites the ownerUserId field with the current user's ID without checking ownership or lead status. The endpoint uses GET HTTP method for a state-changing operation, allowing exploitation via URL-based triggers (link previews, img tags, crawlers). An authenticated user with zero CRM permissions can seize leads from other salespeople, reset follow-up timestamps, and bypass access controls. No patch information was provided in the advisory.
Affected products
- yshop yshop-crm through 2.1.3
Timeline
- 2026-09-16: disclosed: CVE-2026-92459 published