CVE-2026-92460

Name of the Vulnerable Software and Affected Versions yshop-crm versions prior to 2.1.4

Description Insufficient authorization enforcement on the 'GET /admin-api/crm/operatelog/page' endpoint allows any authenticated back-office user to access the installation-wide audit trail. This allows unauthorized retrieval of operator names, display nicknames, client IP addresses, User-Agent strings, request URLs, action details, and customer identifiers.

Recommendations Update to version 2.1.4 or later. Restrict access to the 'GET /admin-api/crm/operatelog/page' endpoint to authorized administrators only.