CVE-2026-111703
Deferred Deferred - Pending Action

Insecure Direct Object Reference in YSHOP-CRM Allowing Unauthorized Customer Data Access

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
yshop-crm through 2.1.3 contains an insecure direct object reference vulnerability that allows authenticated sales users to access other users' customer records by supplying arbitrary ids. Attackers can enumerate ids against the get, update, delete and do-open endpoints to read contact details, overwrite or delete customers, or release them into the public pool.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111703
EUVD
EUVD-2026-102995

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
guchengwuyue yshop-crm 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

yshop-crm through version 2.1.3 has an insecure direct object reference vulnerability. Authenticated sales users can access other users' customer records by providing arbitrary IDs. Attackers can enumerate IDs against endpoints like get, update, delete, and do-open to read contact details, modify or delete customer data, or release customers into the public pool.

Detection Guidance

To detect this vulnerability, monitor API endpoints for unauthorized access attempts to customer records. Check logs for repeated requests to get, update, delete, or do-open endpoints with varying IDs. Look for unusual patterns where authenticated sales users access records outside their permissions.

Impact Analysis

This vulnerability allows unauthorized access to sensitive customer data, enabling attackers to steal, alter, or delete information. It can lead to data breaches, loss of customer trust, and potential financial or reputational damage for affected organizations.

Compliance Impact

This vulnerability can lead to non-compliance with GDPR and HIPAA due to unauthorized access to personal and sensitive data. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. A breach could result in legal penalties and regulatory fines.

Mitigation Strategies

Immediately update yshop-crm to the latest version beyond 2.1.3. Implement strict access controls to prevent ID enumeration. Restrict direct object references by validating user permissions for each request. Review and audit all customer records for unauthorized changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111703. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart