CVE-2026-92461: yshop-crm Information Disclosure Flaw

CVE-2026-92461 Overview

CVE-2026-92461 is a missing authorization vulnerability [CWE-862] affecting yshop-crm through version 2.1.3. The flaw resides in the GET /admin-api/crm/flow/flow-users endpoint. Any authenticated back-office user can query the endpoint and retrieve approval workflow data without a role-based access check. Exposed data includes approval chain topology, step ordering, approver identifiers, login names, nicknames, departments, email addresses, mobile numbers, and last login IP addresses. The disclosure gives lower-privileged operators visibility into organizational structure and approver personal information they should not access.

Critical Impact
Authenticated back-office users can enumerate approval workflow membership and harvest personally identifiable information (PII) about approvers, enabling targeted phishing, social engineering, and reconnaissance for further attacks against the CRM environment.

Affected Products

yshop-crm through version 2.1.3
Component: CrmFlowController / CrmFlowServiceImpl in yshop-module-crm-biz
Endpoint: GET /admin-api/crm/flow/flow-users

Discovery Timeline

2026-09-16 - CVE-2026-92461 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92461

Vulnerability Analysis

yshop-crm exposes an administrative REST interface under /admin-api/. Endpoints in this namespace are intended for privileged operators managing customer relationship management (CRM) workflows. The flow-users endpoint returns the full set of users participating in an approval chain for a given flow.

The controller method in CrmFlowController.java accepts a flow identifier and delegates to CrmFlowServiceImpl.getFlowUsers(). The service performs the lookup and returns approver records without checking whether the calling principal has permission to view that flow. Authentication is enforced, but authorization is not.

An attacker who obtains any low-privileged back-office account, such as a sales operator, can iterate flow IDs and dump approval routing metadata plus approver PII. The information supports targeted phishing against executives or finance approvers and can reveal internal reporting hierarchies.

Root Cause

The root cause is a missing authorization check on the flow-users query path. The endpoint verifies session validity but omits a permission annotation or programmatic role check that would restrict access to users authorized for the specific approval flow or CRM administrative scope.

Attack Vector

The attack is remote and network-based. The attacker must hold valid credentials for any back-office role. Exploitation requires a single authenticated HTTP GET request to /admin-api/crm/flow/flow-users with a flow identifier. No user interaction and no elevated privileges are required. See the VulnCheck Security Advisory and the GitHub PoC Script for request-level detail.

// No verified exploit code is reproduced here. Refer to the linked
// proof-of-concept and the CrmFlowController source for request format.

Detection Methods for CVE-2026-92461

Indicators of Compromise

Repeated GET /admin-api/crm/flow/flow-users requests from a single session, especially with incrementing or brute-forced flow identifiers.
Access to the endpoint by accounts that do not otherwise interact with CRM approval administration.
Bulk retrieval of approver records followed by outbound activity such as phishing email delivery targeting the disclosed addresses.

Detection Strategies

Enable HTTP access logging on the yshop-crm application server and alert on requests to /admin-api/crm/flow/flow-users originating from non-administrative role identifiers.
Correlate authenticated session role with endpoint access. Flag any low-privilege role touching flow administration paths.
Baseline normal request volume for the endpoint and generate an alert on statistical deviations.

Monitoring Recommendations

Forward web server and application logs to a central analytics platform for review of admin-api access patterns.
Monitor for account behavior anomalies such as a sales role suddenly enumerating administrative endpoints.
Track outbound email and messaging traffic to addresses first seen in approval chain responses.

How to Mitigate CVE-2026-92461

Immediate Actions Required

Restrict network access to the /admin-api/ path so it is reachable only from trusted administrative networks or through a VPN.
Audit back-office accounts, disable dormant users, and rotate credentials for accounts with unnecessary CRM privileges.
Review recent access logs for the flow-users endpoint and identify any accounts that queried it without a business reason.

Patch Information

No vendor-supplied patch is referenced in the advisory at the time of publication. Track the GitHub Repository for yshop-crm for a fix that adds an authorization check to CrmFlowController.getFlowUsers. Until then, treat all deployments through version 2.1.3 as vulnerable and apply compensating controls.

Workarounds

Add a reverse-proxy rule that blocks GET /admin-api/crm/flow/flow-users for all clients except approved administrator source addresses.
Introduce a servlet filter or Spring interceptor that enforces a role check for CRM flow administration before the controller executes.
Reduce the number of accounts with any admin-api access to the minimum required for operations.

bash

# Example NGINX rule restricting the endpoint to an admin subnet
location = /admin-api/crm/flow/flow-users {
    allow 10.10.20.0/24;
    deny  all;
    proxy_pass http://yshop_backend;
}