# CVE-2026-92461: yshop-crm missing authorization in approval workflow endpoint

Source: https://junglewise.ai/threats/cve-2026-92461-yshop-crm-missing-authorization-in-approval-workflow-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-92461 · Severity: medium · CVSS 4.3 · Published 2026-09-16

yshop-crm is a CRM sales management system that handles customer relationships, contracts, and approval workflows. A missing authorization flaw in the approval workflow endpoint allows any logged-in employee to view sensitive organizational data including approver identities, approval chain structure, and personal information (email addresses, phone numbers, departments) of all staff involved in contract and invoice approvals, potentially enabling social engineering attacks and organizational intelligence gathering.

## Quick answers

**Is CVE-2026-92461 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92461 being exploited in the wild.

**How severe is CVE-2026-92461?** Medium severity, with a CVSS score of 4.3, published 16 September 2026.

**Which products and versions are affected?** guchengwuyue yshop-crm through 2.1.3.

**Is there a fix for CVE-2026-92461?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-92461 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-92461?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The GET /admin-api/crm/flow/flow-users endpoint lacks @PreAuthorize annotation, allowing any authenticated back-office user to retrieve approval workflow topology regardless of their assigned permissions. The vulnerability exposes adminIds (internal user identifiers), step ordering, business object associations, and personal data including login names, nicknames, departments, email addresses, mobile numbers, and last login IP addresses. Attack requires valid authentication credentials but no additional CRM privileges. The endpoint is documented in the runtime OpenAPI specification and directly reachable. Exposed approver identities can be leveraged to facilitate attacks on other endpoints that accept user identifiers or to perform social engineering against staff members.

## Affected products

- guchengwuyue yshop-crm through 2.1.3

## Timeline

- 2026-09-16: disclosed

## References

- [https://github.com/LinYuanyi1/cve-request-poc/blob/master/yshop-crm/C08_crm_flow_users.py](https://github.com/LinYuanyi1/cve-request-poc/blob/master/yshop-crm/C08_crm_flow_users.py)
- [https://github.com/guchengwuyue/yshop-crm](https://github.com/guchengwuyue/yshop-crm)