Executive brief
yshop-crm is a CRM sales management system that handles customer relationships, contracts, and approval workflows. A missing authorization flaw in the approval workflow endpoint allows any logged-in employee to view sensitive organizational data including approver identities, approval chain structure, and personal information (email addresses, phone numbers, departments) of all staff involved in contract and invoice approvals, potentially enabling social engineering attacks and organizational intelligence gathering.
Technical details
The GET /admin-api/crm/flow/flow-users endpoint lacks @PreAuthorize annotation, allowing any authenticated back-office user to retrieve approval workflow topology regardless of their assigned permissions. The vulnerability exposes adminIds (internal user identifiers), step ordering, business object associations, and personal data including login names, nicknames, departments, email addresses, mobile numbers, and last login IP addresses. Attack requires valid authentication credentials but no additional CRM privileges. The endpoint is documented in the runtime OpenAPI specification and directly reachable. Exposed approver identities can be leveraged to facilitate attacks on other endpoints that accept user identifiers or to perform social engineering against staff members.
Affected products
- guchengwuyue yshop-crm through 2.1.3
Timeline
- 2026-09-16: disclosed