yshop-crm through 2.1.3 fails to enforce authorization on the GET /admin-api/crm/operatelog/page endpoint, allowing any authenticated back-office user to access the installation-wide audit trail. Attackers can query the operation log to retrieve operator names, display nicknames, client IP addresses, User-Agent strings, request URLs, action details, and customer identifiers without proper permission checks.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Guchengwuyue
  • Yshop-crm

No data.

No data.

References
Link Providers
https://github.com/LinYuanyi1/cve-request-poc/blob/master/yshop-crm/C07_crm_operatelog_page.py cve-icon cve-icon
https://github.com/guchengwuyue/yshop-crm cve-icon cve-icon
https://github.com/guchengwuyue/yshop-crm/blob/5f5810a0e1e4ab0828523ec299bf973c2f9065d7/yshop-crm/pom.xml#L30 cve-icon cve-icon
https://github.com/guchengwuyue/yshop-crm/blob/5f5810a0e1e4ab0828523ec299bf973c2f9065d7/yshop-crm/yshop-module-crm/yshop-module-crm-biz/src/main/java/co/yixiang/yshop/module/crm/controller/admin/crmoperatelog/CrmOperatelogController.java#L33 cve-icon cve-icon
https://github.com/guchengwuyue/yshop-crm/blob/5f5810a0e1e4ab0828523ec299bf973c2f9065d7/yshop-crm/yshop-module-crm/yshop-module-crm-biz/src/main/java/co/yixiang/yshop/module/crm/dal/mysql/crmoperatelog/CrmOperatelogMapper.java#L18 cve-icon cve-icon
https://www.vulncheck.com/advisories/yshop-crm-through-2.1.3-missing-authorization-via-crm-operation-log-listing cve-icon cve-icon
History

Thu, 17 Sep 2026 21:15:00 +0000

Type Values Removed Values Added
First Time appeared Guchengwuyue
Guchengwuyue yshop-crm
Vendors & Products Guchengwuyue
Guchengwuyue yshop-crm

Thu, 17 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 16 Sep 2026 11:30:00 +0000

Type Values Removed Values Added
Description yshop-crm through 2.1.3 fails to enforce authorization on the GET /admin-api/crm/operatelog/page endpoint, allowing any authenticated back-office user to access the installation-wide audit trail. Attackers can query the operation log to retrieve operator names, display nicknames, client IP addresses, User-Agent strings, request URLs, action details, and customer identifiers without proper permission checks.
Title yshop-crm through 2.1.3 Missing Authorization via CRM Operation-Log Listing
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published: 2026-09-16T11:07:29.492Z

Updated: 2026-09-17T19:26:47.471Z

Reserved: 2026-09-16T10:57:06.466Z

Link: CVE-2026-92460

cve-icon Vulnrichment

Updated: 2026-09-17T18:40:08.443Z

cve-icon NVD

Status : Deferred

Published: 2026-09-16T12:17:07.480

Modified: 2026-09-23T11:10:00.187

Link: CVE-2026-92460

cve-icon Redhat

No data.