CVE-2026-109173 Overview
CVE-2026-109173 is a missing authorization vulnerability [CWE-862] in yshop-crm through version 2.1.3. The flaw resides in the CrmInvoiceController check handler, which exposes POST /admin-api/crm/invoice/check without proper authorization enforcement. Any authenticated back-office user can approve or reject invoices by supplying an arbitrary invoice ID, bypassing the intended approver workflow.
Critical Impact
Low-privileged authenticated users can approve or reject arbitrary invoices, undermining the integrity of the CRM invoice approval workflow and enabling business logic abuse.
Affected Products
- yshop-crm through version 2.1.3
- yshop-module-crm-biz component containing CrmInvoiceController
- CrmInvoiceServiceImpl invoice check service implementation
Discovery Timeline
- 2026-10-12 - CVE-2026-109173 published to NVD
- 2026-10-13 - Last updated in NVD database
Technical Details for CVE-2026-109173
Vulnerability Analysis
The vulnerability affects the invoice approval workflow in yshop-crm, a Java-based customer relationship management application. The check handler in CrmInvoiceController is responsible for approving or rejecting submitted invoices. However, the handler lacks a Spring Security @PreAuthorize annotation that would restrict access to designated approvers.
In the underlying CrmInvoiceServiceImpl, the logic that would validate whether the current user is a legitimate approver has been commented out. As a result, any authenticated session with access to the back-office admin-api can invoke the endpoint and operate on arbitrary invoice IDs. Attackers do not need elevated privileges, only valid credentials for a low-tier internal account.
This is a business logic authorization failure rather than a technical input-handling bug. The server trusts the request issuer by virtue of authentication alone and does not verify role or ownership before mutating invoice state.
Root Cause
Two related defects produce the weakness. First, the controller method handling POST /admin-api/crm/invoice/check is missing the @PreAuthorize annotation that enforces role-based access control. Second, the service layer approver validation checks were commented out during development and never reinstated. Together these omissions eliminate every authorization gate protecting invoice state transitions.
Attack Vector
Exploitation requires an authenticated session on the yshop-crm admin API. The attacker sends a crafted POST request to /admin-api/crm/invoice/check containing a target invoice id and the desired check result (approve or reject). The server processes the request without verifying whether the caller is an authorized approver, applying the state change to the specified invoice. A proof-of-concept script is publicly available in the GitHub PoC for Invoice Check repository. Additional technical context is in the VulnCheck Advisory on Yshop-CRM.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-109173
Indicators of Compromise
- Unexpected POST requests to /admin-api/crm/invoice/check originating from low-privileged back-office accounts.
- Invoice records transitioning between approval states without matching entries in approver assignment tables.
- Bursts of invoice state changes from a single user ID targeting invoice IDs not previously associated with that user.
Detection Strategies
- Review application access logs for calls to the invoice check endpoint and correlate the acting user against the configured approver list.
- Enable database audit logging on invoice tables to capture user ID, timestamp, and before/after state for every status update.
- Compare approved invoice IDs against the invoice ownership and approver assignment data in the schema referenced in the GitHub SQL Script for Yshop-CRM.
Monitoring Recommendations
- Alert when any user approves or rejects more invoices in a short window than their historical baseline.
- Monitor for sequential enumeration patterns against the id parameter of the invoice check endpoint.
- Forward web application and database audit logs to a central SIEM for retention and correlation with authentication events.
How to Mitigate CVE-2026-109173
Immediate Actions Required
- Restrict network access to the /admin-api/crm/invoice routes to trusted internal networks until a patched build is deployed.
- Audit all invoice approvals performed since deployment of yshop-crm 2.1.3 or earlier and reverse unauthorized state changes.
- Rotate credentials for any back-office accounts that may have been used to abuse the endpoint.
Patch Information
No vendor-supplied patch is referenced in the NVD entry at publication. Operators should track the upstream repository and the VulnCheck Advisory on Yshop-CRM for fix availability. The affected controller and service code paths are documented in the GitHub CrmInvoiceController Code and the GitHub CrmInvoiceServiceImpl Code.
Workarounds
- Apply a reverse-proxy ACL that blocks /admin-api/crm/invoice/check for all users except accounts in the approver role.
- Fork the project and reintroduce the commented-out approver validation inside CrmInvoiceServiceImpl.checkCrmInvoice, rejecting requests where the current user ID does not match the invoice's assigned approver.
- Add a Spring Security @PreAuthorize("@ss.hasPermission('crm:invoice:check')") annotation on the controller method and ensure the permission is granted only to approver roles.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
