CVE-2026-92462

Name of the Vulnerable Software and Affected Versions yshop-crm versions prior to 2.1.4

Description Insufficient authorization checks in the CrmFlowController deleteFlowStep() function allow any authenticated back-office user to delete arbitrary approval workflow steps. This can be achieved by sending a request to the 'DELETE /admin-api/crm/flow/delete-step' endpoint, enabling the removal of steps that govern the finalization of invoices, receivables, and contracts.

Recommendations Update yshop-crm to version 2.1.4 or later. As a temporary mitigation, restrict access to the 'DELETE /admin-api/crm/flow/delete-step' endpoint.