CVE-2026-111703 Details

An insecure direct object reference vulnerability has been identified in Yshop CRM versions through 2.1.3. This vulnerability allows authenticated sales users to access other users' customer records by supplying arbitrary IDs. The issue arises because the by-id endpoints for getting, updating, deleting, and managing customer visibility do not enforce ownership checks. As a result, an attacker can enumerate IDs to access and manipulate contact details, overwrite or delete customer records, or release them into the public pool for others to claim.

To address this vulnerability, implement ownership checks on all by-id customer operations to ensure that users can only access and modify records they own or have been granted permission to. Additionally, add authorization annotations to the four unprotected endpoints that currently allow any admin-side user to send messages or change CRM configuration settings.