Vulnerability Description
yshop-crm through 2.1.3 contains an authorization failure in the GET /admin-api/system/user/page endpoint where the @PreAuthorize annotation is commented out, allowing authenticated back-office users without system:user:list permission to enumerate all users. Attackers with valid back-office credentials and a role with data scope ALL can retrieve the complete user directory including login names, nicknames, departments, email addresses, mobile numbers, and last login information.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/LinYuanyi1/cve-request-poc/blob/master/yshop-crm/C10_system_u
- https://github.com/guchengwuyue/yshop-crm
- https://github.com/guchengwuyue/yshop-crm/blob/5f5810a0e1e4ab0828523ec299bf973c2
- https://github.com/guchengwuyue/yshop-crm/blob/5f5810a0e1e4ab0828523ec299bf973c2
- https://github.com/guchengwuyue/yshop-crm/blob/5f5810a0e1e4ab0828523ec299bf973c2
- https://github.com/guchengwuyue/yshop-crm/blob/5f5810a0e1e4ab0828523ec299bf973c2
- https://www.vulncheck.com/advisories/yshop-crm-through-2.1.3-missing-authorizati
- https://github.com/LinYuanyi1/cve-request-poc/blob/master/yshop-crm/C10_system_u
FAQ
What is CVE-2026-92463?
CVE-2026-92463 is a vulnerability with a CVSS score of 6.5 (MEDIUM). yshop-crm through 2.1.3 contains an authorization failure in the GET /admin-api/system/user/page endpoint where the @PreAuthorize annotation is commented out, allowing authenticated back-office users ...
How severe is CVE-2026-92463?
CVE-2026-92463 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-92463?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.