CVE-2026-109173
Deferred Deferred - Pending Action

Authenticated Invoice Approval Bypass in YShop CRM

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject invoices via POST /admin-api/crm/invoice/check. The CrmInvoiceController check handler lacks @PreAuthorize and approver checks are commented out, letting attackers bypass the invoice approval workflow by supplying any invoice id.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109173
EUVD
EUVD-2026-97377

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
guchengwuyue yshop-crm 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

yshop-crm through version 2.1.3 has a missing authorization vulnerability (CVE-2026-109173) in the invoice approval workflow. The POST /admin-api/crm/invoice/check endpoint lacks proper authorization checks, allowing any authenticated back-office user to approve or reject invoices by supplying any invoice ID. The CrmInvoiceController's check handler is missing @PreAuthorize annotations and has approver checks commented out, enabling attackers to bypass the approval process.

Detection Guidance

To detect this vulnerability, monitor HTTP POST requests to /admin-api/crm/invoice/check from authenticated back-office users. Check for requests with modified check_status or check_admin_id fields. Review commented-out approval validation logic in CrmInvoiceController.java and CrmInvoiceServiceImpl.java. Look for unauthorized invoice status changes in the yshop_crm_invoice table.

Impact Analysis

This vulnerability allows unauthorized users to approve or reject invoices, potentially leading to fraudulent financial transactions. Attackers could manipulate invoice statuses, forge audit logs, and bypass approval workflows without proper permissions. The impact includes financial losses, compromised data integrity, and unauthorized changes to invoice records.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized access to financial data and bypassing approval workflows. GDPR requires proper access controls and audit trails for financial transactions, while HIPAA mandates strict authorization for handling sensitive data. The lack of authorization checks may lead to non-compliance with these standards.

Mitigation Strategies

Immediately update yshop-crm to the latest version beyond 2.1.3. Add @PreAuthorize annotations to the POST /admin-api/crm/invoice/check endpoint. Uncomment and enforce approver checks in CrmInvoiceServiceImpl.java. Restrict database access to prevent unauthorized modifications to invoice tables. Review and remove any commented-out approval logic.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109173. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart