Executive brief
yshop-crm is a Spring Boot-based CRM system designed for enterprise sales teams. The GET /admin-api/crm/operatelog/page endpoint fails to enforce proper access controls, allowing any authenticated back-office user to view the installation-wide audit trail. This exposes sensitive operational data including employee names, IP addresses, system activity details, and customer identifiers that should be restricted to administrators.
Technical details
This is a broken function-level authorization vulnerability in the CrmOperatelogController#getOperatelogPage method. Unlike sibling endpoints in the same controller (create, update, delete, get) which are guarded by @PreAuthorize annotations checking for crm:operatelog:* permissions, this endpoint carries no authorization decorator. The query applies no caller filter or data-scope restriction, returning the complete CRM activity trail of the entire deployment. Attackers with any valid back-office authentication can retrieve operator login names, display nicknames, client IP addresses, User-Agent strings, request URLs, action details, and customer identifiers. The vulnerability requires authenticated access but grants unauthorized access to organization-wide sensitive data. Patches are available in versions after 2.1.3.
Affected products
- yshop-crm yshop-crm through 2.1.3
Timeline
- 2026-09-16: disclosed: CVE-2026-92460 published