CVE-2026-92457

MediumCVSS 6.5/10Last modified Sep 23, 2026

Description

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmInvoiceController issueInvoice endpoint that allows authenticated back-office users to issue arbitrary invoices. Attackers can call the PUT /admin-api/crm/invoice/issue endpoint without required permissions to modify invoice status, inflate contract invoiced amounts with attacker-chosen values, and trigger invoice emails to arbitrary addresses.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
guchengwuyue	yshop-crm	<= 2.1.3

References

Timeline

Published: Sep 16, 2026
Last modified: Sep 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-924584.3yshop-crm through 2.1.3 contains a missing authorization vulnerability in the StoreProductController onSale handler that allows authenticate CVE-2026-924596.5yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmCluesController receiveCustomer endpoint that allows authen CVE-2026-92464.3Improper access control in the entry documentation and attachment features in Devolutions Server allows an authenticated user with vault rea CVE-2026-924606.5yshop-crm through 2.1.3 fails to enforce authorization on the GET /admin-api/crm/operatelog/page endpoint, allowing any authenticated back-o CVE-2026-924614.3yshop-crm through 2.1.3 contains a missing authorization vulnerability in the GET /admin-api/crm/flow/flow-users endpoint that allows any lo CVE-2026-924626.5yshop-crm through 2.1.3 fails to enforce authorization checks on the CrmFlowController deleteFlowStep endpoint, allowing any authenticated b CVE-2026-924636.5yshop-crm through 2.1.3 contains an authorization failure in the GET /admin-api/system/user/page endpoint where the @PreAuthorize annotation CVE-2026-924649.1Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the CVE-2026-924657.6Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum WP Mega Menu allows Blind SQL CVE-2026-924668.8zlt2000 microservices-platform through 6.0.0 contains a missing authorization vulnerability where the zlt.security.auth.urlPermission.enable CVE-2026-924678.3zlt2000 microservices-platform through 6.0.0 contains an unverified password change vulnerability in the PUT /users/password endpoint that a CVE-2026-924686.5zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the search-center service that allows authent