CVE-2026-92456: Guchengwuyue Yshop-CRM

High severity, CVSS 7.1. EPSS: 0.5% chance of exploitation in the next 30 days.

yshop-crm through 2.1.3 fails to enforce authorization on the saveRedisSet and getRedisSet endpoints in CrmCustomerController, allowing any authenticated back-office user to read and modify installation-wide lead-allocation and customer auto-recycling policy. Attackers can invoke these endpoints to manipulate shared Redis keys controlling customer auto-recycling behavior, causing mass customer data deletion, disabling lead recycling, or blocking customer creation across the deployment.

Affected products

• Guchengwuyue Yshop-CRM: up to and including 2.1.3

Published 2026-09-16. Last modified 2026-09-23.