CVE-2026-92459: Guchengwuyue Yshop-CRM

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmCluesController receiveCustomer endpoint that allows authenticated back-office users to claim sales leads without proper permission checks. Attackers can invoke the lead-claim endpoint to reassign leads from other employees to themselves by overwriting the ownerUserId field, with no access logging or quota validation to prevent bulk lead theft.

Affected products

• Guchengwuyue Yshop-CRM: up to and including 2.1.3

Published 2026-09-16. Last modified 2026-09-24.