CVE-2026-109171 Overview
CVE-2026-109171 is a missing authorization vulnerability [CWE-862] affecting yshop-crm through version 2.1.3. The flaw resides in the CrmContractController component, which exposes the POST /admin-api/crm/contract/check endpoint without proper access control. Any authenticated back-office user can approve or reject contracts regardless of their intended role. Approving contracts alters customer deal and purchase data, while rejecting contracts returns products to stock inventory. The vulnerability stems from a missing @PreAuthorize annotation and commented-out approver validation checks in the service layer.
Critical Impact
Authenticated low-privilege users can manipulate CRM contract state, affecting business workflows, inventory tracking, and customer deal integrity across the yshop-crm platform.
Affected Products
- yshop-crm versions up to and including 2.1.3
- CrmContractController admin API component
- CrmContractServiceImpl service implementation
Discovery Timeline
- 2026-10-12 - CVE CVE-2026-109171 published to NVD
- 2026-10-12 - Last updated in NVD database
Technical Details for CVE-2026-109171
Vulnerability Analysis
The vulnerability resides in the contract check workflow of yshop-crm. The POST /admin-api/crm/contract/check endpoint, handled by CrmContractController, accepts contract approval or rejection decisions from authenticated back-office users. The controller method lacks a Spring Security @PreAuthorize annotation, which would normally restrict access to users holding designated approval roles.
In the downstream CrmContractServiceImpl logic, the checks that validate whether the calling user is a legitimate approver for the specific contract are present in the codebase but commented out. The result is that authorization enforcement is effectively absent from both the controller and service layers.
An attacker with any authenticated back-office session can approve contracts to confirm fraudulent deals or alter customer purchase data. Alternatively, rejecting contracts triggers inventory returns, enabling stock manipulation. The impact targets data integrity rather than confidentiality or availability.
Root Cause
The root cause is a missing authorization check [CWE-862] at two layers. The controller does not declare a role requirement via @PreAuthorize, and the service implementation omits runtime checks that compare the current principal against the contract's assigned approver. Authentication alone is treated as sufficient to invoke a privileged state-changing action.
Attack Vector
Exploitation requires valid credentials for any back-office account. The attacker sends a crafted POST request to /admin-api/crm/contract/check with a target contract identifier and the desired check result. The server processes the request and updates the contract state without verifying the caller's authority. Technical reproduction details are documented in the GitHub PoC Repository and the VulnCheck Advisory on yshop-crm.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-109171
Indicators of Compromise
- Unexpected POST requests to /admin-api/crm/contract/check originating from user accounts not assigned contract approval duties.
- Contract state changes (approved or rejected) in CRM audit logs performed by non-approver users.
- Unexplained inventory returns correlated with contract rejection events in the same time window.
Detection Strategies
- Review application access logs for calls to /admin-api/crm/contract/check and cross-reference the acting user against the contract's designated approver.
- Instrument the CrmContractServiceImpl approval workflow to emit audit events including caller identity, contract ID, and decision outcome.
- Deploy web application firewall rules to flag high-frequency check calls or calls from non-approver roles.
Monitoring Recommendations
- Enable verbose auditing on all /admin-api/crm/contract/* endpoints and forward logs to a centralized SIEM for correlation.
- Monitor CRM contract records for state transitions that bypass expected business workflow stages.
- Alert on inventory stock adjustments driven by contract rejection events outside business hours or from unusual IP ranges.
How to Mitigate CVE-2026-109171
Immediate Actions Required
- Restrict access to the /admin-api/crm/contract/check endpoint at the reverse proxy or API gateway level to only known approver accounts.
- Audit all recent contract approvals and rejections to identify unauthorized state changes.
- Rotate credentials for back-office accounts that may have been used to abuse the endpoint.
Patch Information
No official vendor patch is listed in the NVD entry for yshop-crm at the time of publication. Review the referenced source files, including the GitHub CRM Controller Code and the GitHub CRM Service Implementation, and apply the following fixes locally: add a @PreAuthorize annotation to the check controller method and uncomment the approver validation logic in the service implementation.
Workarounds
- Add a Spring Security @PreAuthorize("@ss.hasPermission('crm:contract:approve')") annotation to the controller method handling the check action.
- Reintroduce the commented-out approver verification in CrmContractServiceImpl to compare the current user ID against the contract's assigned approver.
- Block the /admin-api/crm/contract/check route at the gateway until the controller and service fixes are deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
