CVE-2026-92459

MediumCVSS 6.5/10Last modified Sep 24, 2026

Description

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmCluesController receiveCustomer endpoint that allows authenticated back-office users to claim sales leads without proper permission checks. Attackers can invoke the lead-claim endpoint to reassign leads from other employees to themselves by overwriting the ownerUserId field, with no access logging or quota validation to prevent bulk lead theft.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Sep 16, 2026
Last modified: Sep 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-92464.3Improper access control in the entry documentation and attachment features in Devolutions Server allows an authenticated user with vault rea CVE-2026-924606.5yshop-crm through 2.1.3 fails to enforce authorization on the GET /admin-api/crm/operatelog/page endpoint, allowing any authenticated back-o CVE-2026-924614.3yshop-crm through 2.1.3 contains a missing authorization vulnerability in the GET /admin-api/crm/flow/flow-users endpoint that allows any lo CVE-2026-924626.5yshop-crm through 2.1.3 fails to enforce authorization checks on the CrmFlowController deleteFlowStep endpoint, allowing any authenticated b CVE-2026-924636.5yshop-crm through 2.1.3 contains an authorization failure in the GET /admin-api/system/user/page endpoint where the @PreAuthorize annotation CVE-2026-924649.1Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the CVE-2026-924657.6Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum WP Mega Menu allows Blind SQL CVE-2026-924668.8zlt2000 microservices-platform through 6.0.0 contains a missing authorization vulnerability where the zlt.security.auth.urlPermission.enable CVE-2026-924678.3zlt2000 microservices-platform through 6.0.0 contains an unverified password change vulnerability in the PUT /users/password endpoint that a CVE-2026-924686.5zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the search-center service that allows authent CVE-2026-924698.1zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the file-center module DELETE /files/{id} end CVE-2026-92472.4Insufficient logging in the entry export feature in Devolutions Server allows an authenticated user with export permissions to export a seal