CVE-2026-92456: yshop-crm Auth Bypass Vulnerability

CVE-2026-92456 Overview

CVE-2026-92456 is a missing authorization vulnerability [CWE-862] affecting yshop-crm through version 2.1.3. The flaw resides in the saveRedisSet and getRedisSet endpoints of CrmCustomerController, which fail to enforce role-based access control. Any authenticated back-office user can read and modify installation-wide lead-allocation and customer auto-recycling policy stored in shared Redis keys. Exploitation allows attackers to trigger mass customer data deletion, disable lead recycling, or block customer creation across the deployment.

Critical Impact
A low-privileged authenticated user can manipulate shared Redis configuration keys governing customer auto-recycling, resulting in mass deletion of customer records and disruption of core CRM workflows.

Affected Products

yshop-crm through version 2.1.3
CrmCustomerController — saveRedisSet endpoint
CrmCustomerController — getRedisSet endpoint

Discovery Timeline

2026-09-16 - CVE-2026-92456 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92456

Vulnerability Analysis

The vulnerability stems from missing authorization checks on two administrative endpoints in CrmCustomerController. The saveRedisSet and getRedisSet methods write and read Redis keys that control installation-wide customer auto-recycling logic. These keys are consumed by CustomerAutoJob and CrmCustomerServiceImpl to determine whether customers should be reassigned or deleted after a configured idle window.

Because the endpoints only require authentication and not a specific administrative role, any back-office account can alter the recycling policy. Setting an aggressive recycling window causes the scheduled job to mass-delete customer records. Setting values that block customer creation halts core CRM operations across all tenants sharing the deployment.

Root Cause

The root cause is the absence of permission annotations or authorization filters on the saveRedisSet and getRedisSet handlers. yshop-crm's other administrative operations rely on role checks, but these two endpoints were exposed without equivalent gating. See the CrmCustomerController source for the affected handler.

Attack Vector

An attacker requires only valid low-privileged credentials for the back-office web interface. The attacker sends an HTTP request to the saveRedisSet endpoint with crafted values for the recycling configuration. The updated Redis keys are then consumed by CustomerAutoJob on its next execution, applying the malicious policy platform-wide. A public proof of concept is available in the VulnCheck advisory and the GitHub PoC repository.

No verified sanitized exploitation code is included here. Refer to the linked PoC for request structure and payload details.

Detection Methods for CVE-2026-92456

Indicators of Compromise

HTTP requests to /admin-api/crm/customer/saveRedisSet or /admin-api/crm/customer/getRedisSet from non-administrative user sessions.
Unexpected changes to Redis keys controlling customer auto-recycling intervals or lead-allocation policy.
Bulk DELETE operations against customer records shortly after CustomerAutoJob runs.
Application audit log entries showing configuration writes attributed to low-privileged back-office accounts.

Detection Strategies

Instrument the yshop-crm application to log every invocation of saveRedisSet and getRedisSet with the calling user identity and role.
Correlate Redis SET commands against the recycling configuration keys with the originating authenticated session.
Baseline the expected frequency of policy changes and alert on deviations, since these settings rarely change in production.

Monitoring Recommendations

Forward yshop-crm application and access logs to a centralized analytics platform for correlation with Redis and database activity.
Monitor CustomerAutoJob execution outcomes for abnormally high deletion counts.
Alert on privileged Redis key modifications performed outside scheduled change windows.

How to Mitigate CVE-2026-92456

Immediate Actions Required

Restrict network access to the yshop-crm back-office interface to trusted administrators until a patch is applied.
Audit all back-office accounts and revoke unnecessary access to reduce the pool of users who can reach the vulnerable endpoints.
Review Redis keys governing customer auto-recycling for unexpected values and reset them to sanctioned defaults.
Enable verbose audit logging on CrmCustomerController endpoints to support incident response.

Patch Information

No vendor patch is referenced in the enriched CVE data at time of publication. Track the yshop-crm repository and the VulnCheck advisory for updates. Until a fix is available, apply compensating controls at the application and network layers.

Workarounds

Add a reverse-proxy rule that blocks requests to saveRedisSet and getRedisSet from users outside an allowlisted administrative group.
Introduce an authorization filter or Spring Security annotation on the affected handlers to require an administrative role before execution.
Disable or reduce the frequency of CustomerAutoJob while the vulnerability remains unpatched to limit blast radius.
Restrict Redis access to the application service account only, preventing lateral abuse of exposed configuration keys.

bash

# Example nginx rule to block unauthenticated or non-admin access to the vulnerable endpoints
location ~* /admin-api/crm/customer/(saveRedisSet|getRedisSet) {
    allow 10.0.0.0/24;   # admin management subnet
    deny  all;
    proxy_pass http://yshop_backend;
}