CVE-2026-92460: yshop-crm Authorization Bypass Vulnerability

CVE-2026-92460 Overview

CVE-2026-92460 is a missing authorization vulnerability [CWE-862] affecting yshop-crm through version 2.1.3. The flaw resides in the GET /admin-api/crm/operatelog/page endpoint, which fails to enforce role-based access control. Any authenticated back-office user, regardless of assigned privileges, can query the installation-wide audit trail. The exposed data includes operator names, display nicknames, client IP addresses, User-Agent strings, request URLs, action details, and customer identifiers. This gives low-privilege attackers direct access to sensitive operational intelligence that should be restricted to administrators.

Critical Impact
Authenticated attackers with minimal privileges can harvest the full CRM audit log, exposing operator identities, network origins, and customer records across the entire installation.

Affected Products

yshop-crm through version 2.1.3
Deployments using the yshop-module-crm-biz component
Instances exposing the /admin-api/crm/operatelog/page endpoint to authenticated users

Discovery Timeline

2026-09-16 - CVE-2026-92460 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92460

Vulnerability Analysis

The vulnerability exists in the CrmOperatelogController class within the yshop-module-crm-biz module. The controller exposes a paginated listing endpoint at /admin-api/crm/operatelog/page intended to display the CRM operation log. The endpoint requires authentication but does not verify that the calling user holds the required administrative permission to view audit records.

As a result, any account with valid back-office credentials, including low-privilege sales or support users, can invoke the endpoint and page through every operation record stored in the system. The returned data set includes fields describing who performed each action, from which IP address, using which browser, against which customer entity, and what specific request was executed.

This exposure is particularly useful during post-compromise reconnaissance. An attacker who obtains a minor account can enumerate administrator behavior patterns, identify high-value customer records, and map internal workflows without triggering privilege escalation defenses. Refer to the Vulncheck Advisory for YShop CRM for further technical context.

Root Cause

The root cause is missing authorization enforcement on the operation-log paging endpoint. The application relies on authentication alone and omits the @PreAuthorize or equivalent permission-check annotation required to restrict access to privileged roles. See the GitHub Controller Code for CRM Log and the GitHub Mapper Code for CRM Log for the affected implementation.

Attack Vector

An attacker authenticates to the yshop-crm back-office using any valid low-privilege account. The attacker then issues a GET request to /admin-api/crm/operatelog/page with pagination parameters. The server returns audit records in JSON without evaluating whether the user is authorized to view them. A working proof of concept is published in the GitHub PoC for YShop CRM repository.

Detection Methods for CVE-2026-92460

Indicators of Compromise

Repeated GET requests to /admin-api/crm/operatelog/page originating from accounts that are not administrators
Sequential pagination requests iterating pageNo values against the same endpoint within short time windows
Requests to the operation-log endpoint from IP addresses associated with non-administrator sessions or automated tooling

Detection Strategies

Correlate application access logs against role assignments to flag non-admin users invoking /admin-api/crm/operatelog/page
Alert on high-volume paginated reads of the operation-log endpoint that indicate bulk harvesting
Inspect Web Application Firewall (WAF) telemetry for scripted User-Agent strings targeting admin-api routes

Monitoring Recommendations

Enable verbose audit logging for all admin-api/crm/* endpoints and forward to a central SIEM
Baseline expected callers of the operation-log endpoint and alert on new principals accessing it
Track response sizes on the endpoint to detect abnormal bulk retrieval

How to Mitigate CVE-2026-92460

Immediate Actions Required

Restrict access to /admin-api/crm/operatelog/page at the reverse proxy or WAF layer to administrator IP ranges until a patched version is available
Audit back-office user roles and disable or rotate accounts that do not require CRM access
Review historical access logs for prior unauthorized invocations of the operation-log endpoint

Patch Information

No vendor patch is referenced in the NVD entry at the time of publication. Track the GitHub Repository for YShop CRM for upstream fixes. Administrators should apply an authorization check on the CrmOperatelogControllerpage handler, requiring an administrator role or a dedicated crm:operate-log:query permission before invoking the mapper.

Workarounds

Add a server-side authorization filter that rejects non-administrator principals on the operation-log route
Deploy a reverse-proxy rule blocking /admin-api/crm/operatelog/page for all sessions outside an allow-listed administrator group
Temporarily disable the operation-log listing endpoint if it is not actively used by legitimate administrators

bash

# Example nginx rule to restrict the vulnerable endpoint to trusted admin IPs
location = /admin-api/crm/operatelog/page {
    allow 10.0.0.0/24;   # admin subnet
    deny  all;
    proxy_pass http://yshop_backend;
}