CVE-2026-109171

4.3Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

4.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Limited impact
Weakness: CWE-862

Impact

Any low-privileged back-office user can approve or reject arbitrary contracts, modifying deal states and returning inventory to stock. The attacker only needs valid login credentials for the admin portal.

Root cause

The POST /admin-api/crm/contract/check endpoint in CrmContractController lacks the @PreAuthorize annotation and has commented-out approver verification checks.

Affected systems

yshop-crm through 2.1.3

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Fix & remediation

No official patched release is specified yet. Block requests to POST /admin-api/crm/contract/check at your reverse proxy or WAF for non-admin roles, or patch CrmContractController.java directly to add proper @PreAuthorize permission checks.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject contracts by calling POST /admin-api/crm/contract/check. Because CrmContractController lacks @PreAuthorize and approver checks are commented out, attackers can approve contracts to alter customer deal and purchase data or reject them to return products to stock.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109171