CVE-2026-92458

Name of the Vulnerable Software and Affected Versions yshop-crm versions prior to 2.1.4

Description A missing authorization issue exists in the onSale handler of the StoreProductController. This allows authenticated back-office users to modify the sale status of products without proper permission checks. An attacker can use the GET '/admin-api/product/store-product/sale' endpoint with sequential product IDs to either withdraw entire product catalogs from sale or re-enable products that were previously withdrawn.

Recommendations Update yshop-crm to version 2.1.4 or later. As a temporary mitigation, restrict access to the '/admin-api/product/store-product/sale' endpoint.