CVE-2026-92457 Overview
CVE-2026-92457 is a missing authorization vulnerability affecting yshop-crm through version 2.1.3. The flaw resides in the issueInvoice endpoint of the CrmInvoiceController class. Authenticated back-office users can invoke PUT /admin-api/crm/invoice/issue without holding the required permissions. Successful abuse lets attackers modify invoice status, inflate contract invoiced amounts with attacker-chosen values, and dispatch invoice emails to arbitrary recipients. The weakness is tracked under CWE-862: Missing Authorization.
Critical Impact
Any authenticated back-office user, regardless of role, can issue arbitrary invoices, tamper with financial records, and send invoice emails to unauthorized recipients.
Affected Products
- yshop-crm through version 2.1.3
- yshop-module-crm-biz module containing the vulnerable CrmInvoiceController
- Deployments exposing /admin-api/crm/invoice/issue to authenticated users
Discovery Timeline
- 2026-09-16 - CVE-2026-92457 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-92457
Vulnerability Analysis
yshop-crm is a Java-based customer relationship management platform. The CrmInvoiceController exposes an invoice issuance endpoint at PUT /admin-api/crm/invoice/issue that maps to the issueInvoice handler. According to the VulnCheck advisory, the handler and the downstream CrmInvoiceServiceImpl code path fail to enforce the role or permission check expected for invoice issuance. Any user holding a valid session against the admin API can therefore invoke the operation. The service persists the caller-supplied invoice status, contract invoiced amount, and recipient email without validating whether the caller owns the contract or has the required privilege.
Root Cause
The root cause is missing authorization enforcement in a privileged financial workflow. The controller and service layer perform authentication but do not gate the operation behind a permission annotation or programmatic check. The vulnerable service implementation is referenced in the CrmInvoiceServiceImpl source.
Attack Vector
Exploitation requires network access to the admin API and any authenticated back-office account. An attacker sends a crafted PUT request to /admin-api/crm/invoice/issue containing the target invoice ID, a chosen invoiced amount, and a controlled recipient email address. The server processes the request, updates the invoice state, mutates the associated contract's invoiced total, and triggers an outbound email. A public proof-of-concept is published at the GitHub PoC Script. No verified exploit code beyond the referenced PoC is reproduced here.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-92457
Indicators of Compromise
- Unexpected PUT /admin-api/crm/invoice/issue requests originating from low-privilege back-office accounts.
- Invoice status transitions or contract invoiced amount changes attributable to users outside the finance role.
- Outbound invoice emails delivered to external or unknown recipient domains.
- Audit-log entries showing issueInvoice executions without a corresponding approval workflow event.
Detection Strategies
- Instrument the admin API gateway to log the authenticated principal, HTTP method, and path for every /admin-api/crm/invoice/* call.
- Correlate invoice issuance events with the acting user's assigned role and alert on role/action mismatches.
- Baseline normal invoice email recipient domains and flag deviations for review.
Monitoring Recommendations
- Forward application, web server, and mail server logs into a centralized analytics platform for correlation.
- Retain HTTP request bodies for admin API endpoints handling financial state changes to support post-incident review.
- Configure alerts on high-value invoice modifications, particularly those adjusting contract invoiced amounts by large deltas.
How to Mitigate CVE-2026-92457
Immediate Actions Required
- Restrict network exposure of /admin-api/crm/invoice/issue to trusted management networks or VPN users.
- Audit all back-office accounts and revoke sessions belonging to users who should not access invoice workflows.
- Review invoice and contract records issued since deployment for unauthorized modifications and reconcile against expected values.
- Rotate credentials for any account with confirmed unauthorized activity against the invoice API.
Patch Information
At the time of publication, no upstream patch has been referenced by the NVD entry or the VulnCheck advisory. Monitor the yshop-crm GitHub repository for updated releases beyond version 2.1.3 and apply them once available. Downstream operators should add an explicit permission check to the issueInvoice handler and CrmInvoiceServiceImpl.issueInvoice method before any fix release.
Workarounds
- Add a permission annotation such as @PreAuthorize("@ss.hasPermission('crm:invoice:issue')") to the issueInvoice controller method and rebuild the module.
- Front the admin API with a reverse proxy that denies PUT /admin-api/crm/invoice/issue for users outside the finance role.
- Disable the invoice email dispatch feature until a fixed build is deployed to limit downstream impact of any abuse.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
