CVE-2026-92461

Name of the Vulnerable Software and Affected Versions yshop-crm versions prior to 2.1.4

Description A missing authorization issue exists in the 'GET /admin-api/crm/flow/flow-users' endpoint. This allows any authenticated back-office user to access sensitive approval workflow data, including approval chain topology, step ordering, and approver identifiers. Additionally, personal information such as login names, nicknames, departments, email addresses, mobile numbers, and last login IP addresses can be retrieved.

Recommendations Update to version 2.1.4 or later. Restrict access to the 'GET /admin-api/crm/flow/flow-users' endpoint to authorized personnel only.