CVE-2026-92458: Guchengwuyue Yshop-CRM

Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days.

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the StoreProductController onSale handler that allows authenticated back-office users to modify product sale status. Attackers can invoke the GET /admin-api/product/store-product/sale endpoint with sequential product IDs to withdraw entire product catalogs from sale or re-enable withdrawn products without proper permission checks.

Affected products

• Guchengwuyue Yshop-CRM: up to and including 2.1.3

Published 2026-09-16. Last modified 2026-09-23.