CVE-2026-92462 Overview
CVE-2026-92462 is a missing authorization vulnerability [CWE-862] in the yshop-crm application through version 2.1.3. The flaw resides in the CrmFlowController.deleteFlowStep endpoint, which fails to enforce permission checks before deleting approval workflow steps. Any authenticated back-office user can invoke DELETE /admin-api/crm/flow/delete-step to remove arbitrary steps that gate contract, receivable, and invoice finalization. Removing these steps allows business records to bypass required approvals, undermining the integrity of financial workflows within the CRM.
Critical Impact
Authenticated low-privileged users can delete approval workflow steps, allowing financial documents such as contracts, receivables, and invoices to be finalized without the required review.
Affected Products
- yshop-crm through version 2.1.3
- yshop-module-crm-biz component containing CrmFlowController
- Deployments exposing the /admin-api/crm/flow/delete-step endpoint
Discovery Timeline
- 2026-09-16 - CVE-2026-92462 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-92462
Vulnerability Analysis
The vulnerability is a missing authorization defect [CWE-862] in the yshop-crm back-office API. The deleteFlowStep handler exposed at DELETE /admin-api/crm/flow/delete-step accepts an authenticated request and forwards the deletion to CrmFlowServiceImpl without validating whether the caller holds the permission required to modify approval workflows. Because the endpoint sits within admin-api, any user issued a valid back-office session token can call it, regardless of their assigned role. The affected workflow steps govern approvals for contracts, receivables, and invoices, so their removal directly changes how sensitive financial records are validated. This is a business logic integrity issue rather than a memory-safety or injection flaw, and it does not require any exploit chaining to trigger.
Root Cause
The controller method at CrmFlowController.java:102 and its downstream service method at CrmFlowServiceImpl.java:230 omit permission annotations and internal authorization checks. The application authenticates the caller but never authorizes the action, so role-based access control is not applied to step deletion.
Attack Vector
An attacker who possesses any low-privileged back-office account sends a network request to /admin-api/crm/flow/delete-step with a target step identifier. The server removes the requested approval step, allowing subsequent contract, receivable, or invoice records to proceed without the intended reviewer sign-off. A public proof-of-concept script is available at GitHub PoC for CVE-2026-92462.
The vulnerability manifests as an unprotected authenticated API route. See the VulnCheck Advisory for yshop-crm and the GitHub CrmFlowController Code for the vulnerable handler.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-92462
Indicators of Compromise
- HTTP DELETE requests to /admin-api/crm/flow/delete-step originating from accounts that lack CRM workflow administration rights.
- Missing approval steps in contract, receivable, or invoice flows that previously required multi-stage review.
- Audit log entries showing deletions from the crm_flow step tables without corresponding administrator activity.
Detection Strategies
- Review application access logs for calls to /admin-api/crm/flow/delete-step and correlate the calling user with expected CRM administrator roles.
- Compare current approval workflow definitions against a known-good baseline to identify unexpected step removals.
- Enable database-level auditing on the CRM flow step tables to capture DELETE operations and the associated session context.
Monitoring Recommendations
- Alert on any invocation of the workflow modification endpoints by non-administrator accounts.
- Track sudden reductions in the number of steps within active approval flows tied to financial records.
- Monitor for finalized contracts, receivables, or invoices that skipped previously required approval stages.
How to Mitigate CVE-2026-92462
Immediate Actions Required
- Restrict network access to the yshop-crm admin-api interface so only trusted management networks can reach it.
- Revoke or downgrade back-office accounts that do not require CRM workflow administration privileges.
- Audit existing approval flows to confirm no steps have been removed without authorization and restore them from backup if needed.
Patch Information
No vendor-supplied patch is referenced in the enriched CVE data at the time of publication. Track the GitHub Repository for yshop-crm and the VulnCheck Advisory for yshop-crm for fix availability. Operators should plan to add server-side permission checks to CrmFlowController.deleteFlowStep and its service implementation, enforcing the same role required to create or edit approval workflow steps.
Workarounds
- Place a reverse proxy or web application firewall rule in front of the application to block DELETE requests to /admin-api/crm/flow/delete-step for all users except a defined administrator allowlist.
- Apply a local patch that adds a permission annotation to the controller method and re-validates the caller's role inside CrmFlowServiceImpl before deletion.
- Reduce the blast radius by enforcing least-privilege role assignments across all back-office accounts and rotating credentials for accounts suspected of misuse.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
