CVE-2026-92455 Details
Description
yshop-crm through 2.1.3 fails to enforce authorization on the sendSms and sendMail endpoints in CrmCustomerController, allowing any authenticated back-office user to send SMS and email to arbitrary customers. Attackers can invoke POST /admin-api/crm/customer/send-sms and POST /admin-api/crm/customer/send-mail with arbitrary customerIds, templateCode, and templateParams to deliver unauthorized messages through the organization's SMS and email channels.
A vulnerability exists in Yshop CRM versions through 2.1.3, where the application fails to properly enforce authorization on the 'sendSms' and 'sendMail' endpoints within the 'CrmCustomerController'. This oversight allows any authenticated back-office user, even those with no permissions, to send SMS messages and emails to arbitrary customers. The 'sendSms' and 'sendMail' methods lack the necessary authorization annotations, leaving them open for exploitation. The issue arises because these methods do not verify the caller's permissions before processing requests, enabling unauthorized communication through the organization's SMS and email channels.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 16, 2026CISA-ADP
Assessed Sep 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| yshop-crm | <= 2.1.3 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 23, 2026 | CVE Translated | [email protected] |
| Sep 17, 2026 | CVE Modified | CISA-ADP |
| Sep 16, 2026 | New CVE Received | [email protected] |