CVE-2026-92457

Name of the Vulnerable Software and Affected Versions yshop-crm versions prior to 2.1.4

Description Authenticated back-office users can issue arbitrary invoices due to missing authorization in the CrmInvoiceController issueInvoice() function. By calling the PUT '/admin-api/crm/invoice/issue' endpoint, an attacker can modify invoice status, inflate contract invoiced amounts using custom values, and trigger invoice emails to arbitrary addresses without the necessary permissions.

Recommendations Update yshop-crm to version 2.1.4 or later. Restrict access to the '/admin-api/crm/invoice/issue' endpoint to only authorized personnel.