CVE-2026-92455: yshop-crm Authorization Bypass Vulnerability

CVE-2026-92455 Overview

CVE-2026-92455 is a missing authorization vulnerability [CWE-862] affecting yshop-crm through version 2.1.3. The application fails to enforce authorization on the sendSms and sendMail endpoints in CrmCustomerController. Any authenticated back-office user can invoke these endpoints to deliver arbitrary SMS and email messages to any customer record. Attackers submit crafted POST /admin-api/crm/customer/send-sms and POST /admin-api/crm/customer/send-mail requests with arbitrary customerIds, templateCode, and templateParams values. This abuse routes unauthorized messages through the organization's legitimate SMS and email channels.

Critical Impact
Low-privileged back-office accounts can send unauthorized SMS and email to arbitrary customers, enabling phishing, brand abuse, and consumption of paid messaging quotas.

Affected Products

yshop-crm through version 2.1.3
CrmCustomerController component (send-sms endpoint)
CrmCustomerController component (send-mail endpoint)

Discovery Timeline

2026-09-16 - CVE-2026-92455 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92455

Vulnerability Analysis

The defect resides in the CRM customer messaging surface of yshop-crm. Two administrative endpoints, send-sms and send-mail, are exposed under /admin-api/crm/customer/ without object-level authorization checks. The controller accepts a list of customerIds along with a templateCode and templateParams map, then invokes the SMS and email service layer to dispatch messages. Because authorization is not enforced against the target customer records or the messaging action itself, any authenticated user with back-office access can target any customer in the CRM database. The service implementation in CrmCustomerServiceImpl proceeds with delivery using the organization's configured providers.

Root Cause

The root cause is missing authorization [CWE-862] on privileged messaging endpoints. Authentication alone gates access to send-sms and send-mail, and no permission check validates that the caller has rights to message the specified customers or to invoke the customer-messaging function. The controller and service layer trust the authenticated session context without enforcing role or ownership constraints. See the CrmCustomerController source and the corresponding CrmCustomerServiceImpl source for the affected code paths.

Attack Vector

An attacker authenticates to the back office with any valid low-privilege account. The attacker then issues POST /admin-api/crm/customer/send-sms or POST /admin-api/crm/customer/send-mail supplying arbitrary customerIds, a valid templateCode, and matching templateParams. The server accepts the request and dispatches messages through the tenant's SMS and email providers. Public proof-of-concept scripts demonstrate the attack: C01_crm_customer_send_sms.py and C02_crm_customer_send_mail.py. Refer to the VulnCheck advisory for further technical detail.

Detection Methods for CVE-2026-92455

Indicators of Compromise

Unexpected POST requests to /admin-api/crm/customer/send-sms or /admin-api/crm/customer/send-mail from non-marketing user accounts.
Spikes in SMS or email dispatch volume that do not correlate with scheduled campaigns.
Requests containing large or unusual customerIds arrays from a single authenticated session.
Customer complaints about unsolicited messages referencing internal template identifiers.

Detection Strategies

Baseline the normal callers of the customer messaging endpoints and alert on new user IDs invoking them.
Correlate application access logs with SMS and email provider delivery logs to detect mismatches between requesting user role and message volume.
Monitor authentication logs for low-privilege accounts issuing back-office API calls outside their functional scope.

Monitoring Recommendations

Enable verbose access logging on CrmCustomerController endpoints, capturing user ID, customerIds, and templateCode parameters.
Forward application, provider, and authentication logs to a central analytics platform for cross-source correlation.
Set rate-limit alerts on outbound SMS and email volume per back-office user.

How to Mitigate CVE-2026-92455

Immediate Actions Required

Restrict network access to the yshop-crm back office to trusted operator networks until a patched build is deployed.
Rotate back-office credentials and audit accounts that hold access to the CRM messaging module.
Review recent SMS and email provider logs for unauthorized dispatches and notify affected customers if abuse is confirmed.
Add a reverse-proxy authorization rule that blocks non-authorized roles from reaching send-sms and send-mail paths.

Patch Information

No vendor patch is referenced in the enriched advisory data at the time of publication. Track the yshop-crm repository and the VulnCheck advisory for a fixed release. Operators maintaining forks should add server-side permission checks in CrmCustomerController and CrmCustomerServiceImpl that validate both the caller's role and ownership of the targeted customerIds before invoking the SMS or email service.

Workarounds

Deploy a web application firewall rule that denies /admin-api/crm/customer/send-sms and /admin-api/crm/customer/send-mail requests from users outside an allowlisted marketing role group.
Enforce per-user rate limits on outbound SMS and email dispatches through the messaging provider dashboards.
Disable the SMS and email dispatch features in the back office until authorization is properly enforced in the application code.

bash

# Example nginx rule restricting access to messaging endpoints by source IP
location ~ ^/admin-api/crm/customer/send-(sms|mail)$ {
    allow 10.10.20.0/24;   # marketing operations subnet
    deny  all;
    proxy_pass http://yshop_backend;
}