Description

yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject invoices via POST /admin-api/crm/invoice/check. The CrmInvoiceController check handler lacks @PreAuthorize and approver checks are commented out, letting attackers bypass the invoice approval workflow by supplying any invoice id.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-10-12T13:17:29.870Z",
  "pubdate": "2026-10-12T13:17:29.870Z",
  "executiveSummary": "The yshop-crm application, specifically versions 2.1.3 and earlier, contains a critical missing authorization vulnerability within the administrative API. This flaw resides in the handling of invoice approval workflows, allowing an authenticated back-office user to manipulate the state of any invoice system-wide.\nThe vulnerability is categorized as a Broken Access Control issue. By interacting with the /admin-api/crm/invoice/check endpoint, an attacker can approve or reject invoices regardless of their designated authority or role-based access control (RBAC) constraints.\nThe impact is significant, as it permits unauthorized users to bypass established financial and operational approval workflows. This could lead to unauthorized invoice processing, potential financial irregularities, and the compromise of business integrity.\nExploitation requires the attacker to be an authenticated back-office user. No further special privileges are required, as the application fails to validate the initiator's authority against the requested resource ID. The lack of secondary access checks enables direct state transitions for sensitive records.",
  "technicalDetails": "The root cause of this vulnerability is the absence of server-side authorization checks within the CrmInvoiceController, specifically within the check handler responsible for invoice state transitions. Analysis of the source code reveals that the expected security annotations, such as @PreAuthorize, are missing from the method signature.\nFurthermore, the internal logic intended to verify the identity and permissions of the approver has been explicitly commented out, effectively disabling the security layer meant to gate access to the invoice approval process. This results in the backend blindly accepting incoming POST requests to /admin-api/crm/invoice/check without validating if the current session possesses the necessary authorization to perform the requested action on the provided invoice ID.\nThe attack flow proceeds as follows: An authenticated attacker submits a POST request to the endpoint /admin-api/crm/invoice/check. The request payload includes a target invoice identifier. Because the controller lacks authorization middleware, the application processes the request and executes the status change logic in the underlying service layer. The application does not check if the user is authorized to manage the specified invoice, nor does it verify that the request follows the defined business logic lifecycle.\nThis vulnerability is present in yshop-crm up to and including version 2.1.3. The exposure is limited to authenticated users; however, in environments where multiple back-office roles exist with varying levels of trust, this vulnerability allows for horizontal and vertical privilege escalation regarding financial document processing. An attacker can systematically iterate through invoice IDs to modify their approval status, leading to unauthorized state changes across the entire CRM infrastructure.\nThe post-exploitation impact includes the successful bypass of business-critical validation checkpoints. By forcing an invoice to an 'approved' status, an attacker could manipulate financial workflows or trigger downstream automated processes that rely on the invoice's approved status. This lack of authorization allows for an integrity violation where system state transitions no longer reflect legitimate business authorization processes."
}