Live › vulnerability › CVE-2026-111703
Go to dashboardyshop-crm through 2.1.3 lets an authenticated sales user access other users' customer records by supplying arbitrary ids to the get, update, delete and do-open endpoints. An attacker can enumerate ids to read contact details, overwrite or delete customers, or release them into the public pool.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Deployments of yshop-crm up to and including 2.1.3 where sales-role users share one customer table and the endpoints do not check record ownership. Teams that run a patched version or do not use yshop-crm can skip it. Whether a given install has the flaw cannot be confirmed from the sources.
No product ranges from the sources yet.
2.1.3 (unknown how the sources expect it to be read in your deployment)2.1.3 (unknown fixed version; the sources do not say)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
yshop-crm through 2.1.3 contains an insecure direct object reference vulnerability that allows authenticated sales users to access other users' customer records by supplying arbitrary ids. Attackers can enumerate ids against the get, update, delete and do-open endpoints to read contact details, overwrite or delete customers, or release them into the public pool.
This page as .md · .json · in your agent: get_signal("CVE-2026-111703")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.