CVE-2026-109171
Deferred Deferred - Pending Action

Authenticated Contract Approval Bypass in YShop CRM

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject contracts by calling POST /admin-api/crm/contract/check. Because CrmContractController lacks @PreAuthorize and approver checks are commented out, attackers can approve contracts to alter customer deal and purchase data or reject them to return products to stock.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109171
EUVD
EUVD-2026-97375

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
guchengwuyue yshop-crm 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a missing authorization vulnerability in yshop-crm through version 2.1.3. It allows any authenticated back-office user to approve or reject contracts by calling the POST /admin-api/crm/contract/check endpoint. The vulnerability exists because the CrmContractController lacks proper authorization checks (@PreAuthorize annotation) and approver validation logic is commented out in the code.

Detection Guidance

Check if the POST /admin-api/crm/contract/check endpoint is accessible without proper authorization. Monitor for unauthorized contract approvals or rejections in logs. Verify if @PreAuthorize annotations are missing in CrmContractController.java.

Impact Analysis

Attackers with back-office access can approve contracts to alter customer deal and purchase data or reject contracts to return products to stock. This could lead to financial losses, incorrect inventory counts, or unauthorized changes to customer agreements without proper approval workflows.

Compliance Impact

This vulnerability could lead to unauthorized modifications of customer deal and purchase data or product stock, which may violate data integrity and access control requirements in GDPR and HIPAA. Unauthorized approvals or rejections of contracts could result in improper handling of personal or sensitive health information, potentially breaching compliance.

Mitigation Strategies

Apply the latest patch for yshop-crm 2.1.3 or later. Ensure @PreAuthorize annotations are added to the /admin-api/crm/contract/check endpoint. Re-enable commented-out approver checks in CrmContractServiceImpl.java. Restrict access to back-office users and audit contract approvals.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109171. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart