Executive brief
yshop-crm is a CRM and sales management system used by enterprises to track contracts, invoices, and receivables. An authorization bypass in the approval workflow engine allows any authenticated back-office user to silently delete critical approval steps that control contract finalization and payment processing, disrupting business workflows without audit trails.
Technical details
The CrmFlowController deleteFlowStep endpoint (DELETE /admin-api/crm/flow/delete-step) lacks @PreAuthorize annotations that guard other methods in the same controller (create, update, delete, get, page). Authenticated users—including those with minimal role privileges—can invoke this endpoint to delete arbitrary approval workflow steps by iterating numeric step IDs. The vulnerable handler returns success (code: 0, data: true) even for non-existent step IDs, providing no validation or error reporting and making destructive operations silent. An attacker can systematically delete workflow steps controlling contract, receivable, and invoice approval chains, causing downstream routing failures and rendering workflows unrecoverable without backups. No patch or mitigation is mentioned in the advisory; deploying version 2.1.3 or earlier carries this risk.
Affected products
- yshop yshop-crm through 2.1.3
Timeline
- 2026-09-16: disclosed