# CVE-2026-92463: yshop-crm authorization bypass in user enumeration endpoint

Source: https://junglewise.ai/threats/cve-2026-92463-yshop-crm-authorization-bypass-in-user-enumeration-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-92463 · Severity: medium · CVSS 6.5 · Published 2026-09-16

yshop-crm is a CRM sales management system built on Spring Boot and Vue3. A commented-out authorization check in the user listing endpoint allows authenticated back-office users with ANY role to enumerate all system users and retrieve sensitive details including email addresses, phone numbers, and login history—information that should be restricted to administrators with explicit user management permissions.

Technologies: [Yshop-Crm](https://junglewise.ai/threats/technologies/yshop-crm). Vendors: [Yshop-Crm](https://junglewise.ai/threats/vendors/yshop-crm).

## Quick answers

**Is CVE-2026-92463 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92463 being exploited in the wild.

**How severe is CVE-2026-92463?** Medium severity, with a CVSS score of 6.5, published 16 September 2026.

**Which products and versions are affected?** Yshop-Crm through 2.1.3.

**Is there a fix for CVE-2026-92463?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-92463 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-92463?** Check whether you run Yshop-Crm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a broken function-level authorization flaw in the GET /admin-api/system/user/page endpoint of yshop-crm. The @PreAuthorize annotation that enforces the system:user:list permission check has been commented out in the UserController class (line 92), leaving the endpoint accessible to any authenticated user with a valid back-office session. Access control falls back to data scope validation only; a role with the default data scope of ALL (value 1) can retrieve the complete user directory. An attacker with valid credentials and an empty role (no menu permissions) can enumerate all users and extract login names, nicknames, departments, email addresses, mobile numbers, and last login timestamps. Sibling endpoints like /system/user/get still enforce proper authorization, creating a privilege escalation gap. No patch information is currently publicly available.

## Affected products

- yshop-crm yshop-crm through 2.1.3

## Timeline

- 2026-09-16: disclosed

## References

- [https://github.com/LinYuanyi1/cve-request-poc/blob/master/yshop-crm/C10_system_user_page_enum.py](https://github.com/LinYuanyi1/cve-request-poc/blob/master/yshop-crm/C10_system_user_page_enum.py)
- [https://github.com/guchengwuyue/yshop-crm](https://github.com/guchengwuyue/yshop-crm)

## Related threats

- [yshop-crm authorization bypass in operatelog endpoint](https://junglewise.ai/threats/cve-2026-92460-yshop-crm-authorization-bypass-in-operatelog-endpoint)
- [yshop-crm missing authorization in StoreProductController](https://junglewise.ai/threats/cve-2026-92458-yshop-crm-missing-authorization-in-storeproductcontroller)
- [yshop-crm authorization bypass in invoice issuance](https://junglewise.ai/threats/cve-2026-92457-yshop-crm-authorization-bypass-in-invoice-issuance)
- [yshop-crm authorization bypass in CrmCustomerController](https://junglewise.ai/threats/cve-2026-92456-yshop-crm-authorization-bypass-in-crmcustomercontroller)
- [yshop-crm authorization bypass in sendSms and sendMail](https://junglewise.ai/threats/cve-2026-92455-yshop-crm-authorization-bypass-in-sendsms-and-sendmail)