CVE-2026-109171

EUVD-2026-97375
yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject contracts by calling POST /admin-api/crm/contract/check. Because CrmContractController lacks @PreAuthorize and approver checks are commented out, attackers can approve contracts to alter customer deal and purchase data or reject them to return products to stock.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/yshop-crm/poc_crm_contract_check.py
https://github.com/guchengwuyue/yshop-crm/blob/a77250f7ace63d5b6b363841d9ff441e0e2a9a6b/yshop-crm/sql/yshop-crm-open-source.sql#L2637
https://github.com/guchengwuyue/yshop-crm/blob/a77250f7ace63d5b6b363841d9ff441e0e2a9a6b/yshop-crm/yshop-module-crm/yshop-module-crm-biz/src/main/java/co/yixiang/yshop/module/crm/controller/admin/crmcontract/CrmContractController.java#L100-L106
https://github.com/guchengwuyue/yshop-crm/blob/a77250f7ace63d5b6b363841d9ff441e0e2a9a6b/yshop-crm/yshop-module-crm/yshop-module-crm-biz/src/main/java/co/yixiang/yshop/module/crm/service/crmcontract/CrmContractServiceImpl.java#L315-L432
https://www.vulncheck.com/advisories/yshop-crm-through-2.1.3-missing-authorization-via-admin-api-crm-contract-check