Executive brief
yshop-crm is a CRM sales management system built on Spring Boot and Vue3. A commented-out authorization check in the user listing endpoint allows authenticated back-office users with ANY role to enumerate all system users and retrieve sensitive details including email addresses, phone numbers, and login history—information that should be restricted to administrators with explicit user management permissions.
Technical details
The vulnerability is a broken function-level authorization flaw in the GET /admin-api/system/user/page endpoint of yshop-crm. The @PreAuthorize annotation that enforces the system:user:list permission check has been commented out in the UserController class (line 92), leaving the endpoint accessible to any authenticated user with a valid back-office session. Access control falls back to data scope validation only; a role with the default data scope of ALL (value 1) can retrieve the complete user directory. An attacker with valid credentials and an empty role (no menu permissions) can enumerate all users and extract login names, nicknames, departments, email addresses, mobile numbers, and last login timestamps. Sibling endpoints like /system/user/get still enforce proper authorization, creating a privilege escalation gap. No patch information is currently publicly available.
Affected products
- yshop-crm yshop-crm through 2.1.3
Timeline
- 2026-09-16: disclosed