CVE-2026-109172

4.3Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

4.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Limited impact
Weakness: CWE-862

Impact

Authenticated back-office users can approve or reject arbitrary receivables records, forging approval logs and tampering with contract returned money. An attacker only needs basic valid credentials to the admin interface.

Root cause

The contract receivables check endpoint lacks an authorization annotation and its backend service implementation has approver validation checks commented out.

Affected systems

yshop-crm through 2.1.3

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Fix & remediation

No official fixed version is stated; block access to POST /admin-api/crm/contract-receivables/check at the reverse proxy or WAF until code patches can uncomment the check logic and add @PreAuthorize controls.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject receivables records by calling POST /admin-api/crm/contract-receivables/check. The handler lacks a @PreAuthorize check and the approver checks in CrmContractReceivablesServiceImpl.check are commented out, so attackers can approve records by id, inflating contract return_money and forging approval logs.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109172