Description

yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject contracts by calling POST /admin-api/crm/contract/check. Because CrmContractController lacks @PreAuthorize and approver checks are commented out, attackers can approve contracts to alter customer deal and purchase data or reject them to return products to stock.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-10-12T13:17:29.520Z",
  "pubdate": "2026-10-12T13:17:29.520Z",
  "executiveSummary": "The yshop-crm application, specifically versions through 2.1.3, is susceptible to a critical missing authorization vulnerability. This flaw resides within the contract management module, exposing the administrative API to unauthorized state manipulation.\nThe vulnerability type is categorized as an improper access control issue. It allows any authenticated back-office user to bypass intended business logic and security constraints, effectively enabling them to approve or reject customer contracts.\nThe impact is significant, as it grants attackers the ability to manipulate sensitive customer deal and purchase data, or force products back into inventory management systems without proper authorization. This directly threatens data integrity and operational financial controls.\nThe vulnerability is exploitable by any user already possessing valid back-office authentication credentials. No further elevated privileges are required, making it a major risk for internal threat actors or compromised low-privilege accounts. Exploitation involves sending a crafted HTTP POST request to the affected endpoint, requiring no advanced technical skills or specialized tools beyond standard web request capabilities.",
  "technicalDetails": "The root cause of this vulnerability is the complete absence of server-side authorization checks within the CrmContractController, specifically affecting the /admin-api/crm/contract/check endpoint. The application fails to enforce the @PreAuthorize annotation, which is standard practice in Spring-based applications to restrict access based on user roles or specific permissions.\nFurthermore, the logic responsible for validating the identity of the contract approver has been explicitly commented out in the source code. This leaves the function exposed, treating any request sent to the endpoint as a valid administrative command. Because the controller lacks the necessary security interception, the application logic proceeds to process contract state transitions regardless of the session user's authority.\nThe attack flow is straightforward: 1) An attacker authenticates as a standard back-office user. 2) The attacker identifies the target contract ID through legitimate observation or enumeration. 3) The attacker crafts an HTTP POST request targeting the /admin-api/crm/contract/check endpoint, including the contract ID and the desired status parameter (approve or reject) in the request body. 4) The server receives the request and, due to the missing access control checks, executes the business logic that updates the database entry for the specified contract.\nBy manipulating the contract state, an attacker can influence the financial pipeline of the CRM. Approving fraudulent or unauthorized contracts may allow for the misappropriation of deals or the falsification of purchase records. Conversely, rejecting legitimate contracts triggers the logic associated with product returns, causing inventory records to be erroneously updated and potentially causing inventory depletion or stock-level discrepancies. The lack of validation means these operations are performed without any audit trail or authorization verification, bypassing the mandatory oversight required for sensitive CRM operations. The vulnerability is present in versions up to 2.1.3 and persists as long as the controller remains unannotated and the backend logic remains commented out."
}