Description

yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject receivables records by calling POST /admin-api/crm/contract-receivables/check. The handler lacks a @PreAuthorize check and the approver checks in CrmContractReceivablesServiceImpl.check are commented out, so attackers can approve records by id, inflating contract return_money and forging approval logs.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-10-12T13:17:29.697Z",
  "pubdate": "2026-10-12T13:17:29.697Z",
  "executiveSummary": "The yshop-crm application, specifically versions through 2.1.3, is susceptible to a critical broken access control vulnerability.\nThis flaw involves a missing authorization check within the administrative API responsible for contract receivable processing.\nAn authenticated back-office user can exploit this vulnerability to approve or reject receivables records without possessing the required administrative privileges.\nThe vulnerability stems from an absent security constraint at the controller layer and commented-out validation logic within the service layer.\nSuccessful exploitation allows unauthorized manipulation of financial data, specifically inflating contract 'return_money' fields and the generation of fraudulent approval logs, which can compromise the integrity of the organization's financial reporting and auditing mechanisms.\nThe risk is elevated because the exploitation requires only an existing authenticated session within the back-office environment, posing a significant risk of insider threat or account takeover exploitation.",
  "technicalDetails": "The vulnerability is identified as a broken access control flaw within the CRM module of the yshop-crm platform. The specific endpoint affected is 'POST /admin-api/crm/contract-receivables/check', which is designed to handle the approval or rejection of contractual receivables.\nThe root cause is twofold: first, the controller handling the request lacks necessary security annotations such as '@PreAuthorize', which would typically restrict access based on the user's role or authority level. Second, the backend logic located in 'CrmContractReceivablesServiceImpl.check' contains commented-out code sections that were intended to perform authorization checks on the user initiating the approval process.\nBecause these security controls are either absent or explicitly disabled, the system treats all incoming requests to the 'check' endpoint as legitimate, provided the requester is an authenticated user of the back-office system.\nThe attack flow begins when an attacker identifies the target contract ID for which they wish to force an approval. The attacker intercepts or crafts a POST request targeting '/admin-api/crm/contract-receivables/check', passing the target ID within the request body. Because the backend service does not validate the requester's permissions against the business logic, the application proceeds to process the request as if it were an authorized administrative action.\nThe exploitation allows an attacker to manipulate the state of 'return_money' fields associated with specific contracts. By successfully invoking the 'check' function, the attacker triggers the underlying database update logic, which modifies the financial records of the contract. Furthermore, the application generates approval logs that appear to be legitimate, thereby obfuscating the unauthorized activity from standard audit trails. This level of access enables the attacker to commit financial fraud or alter the operational state of the CRM to suit malicious objectives.\nThe vulnerability is present in versions up to 2.1.3. It requires an active session, but does not necessitate elevated administrative privileges, meaning any user with back-office access can perform unauthorized actions beyond their assigned role scope."
}