yshop-crm through 2.1.3 Missing Authorization via CRM Customer Rule-Configuration Endpoints

Summary

yshop-crm through 2.1.3 fails to enforce authorization on the saveRedisSet and getRedisSet endpoints in CrmCustomerController, allowing any authenticated back-office user to read and modify installation-wide lead-allocation and customer auto-recycling policy. Attackers can invoke these endpoints to manipulate shared Redis keys controlling customer auto-recycling behavior, causing mass customer data deletion, disabling lead recycling, or blocking customer creation across the deployment.

Timeline

1. Sep 16, 2026, 11:07 AM UTCCVE published
2. Sep 16, 2026, 1:27 PM UTCCISA SSVC assessment

   Exploitation: poc · Automatable: no · Technical impact: partial

3. Sep 16, 2026, 1:27 PM UTCRecord last updated

Affected versions

• guchengwuyue yshop-crm

  through 2.1.3

References 7