{"id":"CVE-2026-111703","kind":"vulnerability","aliases":["CVE-2026-111703"],"related":[],"title":"yshop-crm: sales users can read and change other users' customer records","description":"yshop-crm through 2.1.3 contains an insecure direct object reference vulnerability that allows authenticated sales users to access other users' customer records by supplying arbitrary ids. Attackers can enumerate ids against the get, update, delete and do-open endpoints to read contact details, overwrite or delete customers, or release them into the public pool.","summary":"yshop-crm through 2.1.3 lets an authenticated sales user access other users' customer records by supplying arbitrary ids to the get, update, delete and do-open endpoints. An attacker can enumerate ids to read contact details, overwrite or delete customers, or release them into the public pool.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","sales-team","self-hosted","yshop-crm"],"not_affected_if":["not-using-yshop-crm","patched-version"],"how_to_check":"- Check the installed yshop-crm version against `2.1.3` (unknown how the sources expect it to be read in your deployment)\n- Review the customer get, update, delete and do-open endpoints for an ownership check on the record id (unknown which file or route names the sources expect)","fix":"- Upgrade yshop-crm past `2.1.3` (unknown fixed version; the sources do not say)\n- Until patched, restrict access to the customer endpoints to record owners at the application level or limit sales-user accounts","status":"open","published_at":"2026-10-16T18:17:54+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T04:01:52+00:00","updated_at":"2026-10-25T04:01:52+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:01:52Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade yshop-crm past `2.1.3` (unknown fixed version; the sources do not say)\n- Until patched, restrict access to the customer endpoints to record owners at the application level or limit sales-user accounts","reach":"network","title":"yshop-crm: sales users can read and change other users' customer records","impact":"medium","summary":"yshop-crm through 2.1.3 lets an authenticated sales user access other users' customer records by supplying arbitrary ids to the get, update, delete and do-open endpoints. An attacker can enumerate ids to read contact details, overwrite or delete customers, or release them into the public pool.","category":"package","nicknames":[],"who_cares":["yshop-crm","self-hosted","sales-team"],"confidence":0.6,"needs_auth":"yes","worst_case":"sales user reads, overwrites or deletes other users' customer records","analyst_note":"Find the fixed version and the upstream commit or advisory for yshop-crm; the NVD entry alone does not give the patched release.","how_to_check":"- Check the installed yshop-crm version against `2.1.3` (unknown how the sources expect it to be read in your deployment)\n- Review the customer get, update, delete and do-open endpoints for an ownership check on the record id (unknown which file or route names the sources expect)","needs_analyst":true,"not_affected_if":["patched-version","not-using-yshop-crm"],"who_is_affected":"Deployments of yshop-crm up to and including 2.1.3 where sales-role users share one customer table and the endpoints do not check record ownership. Teams that run a patched version or do not use yshop-crm can skip it. Whether a given install has the flaw cannot be confirmed from the sources.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000646,"input_tokens":3332,"output_tokens":626,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111703':16A,19A '-2026':15A,18A '2.1.3':34B,83C 'access':40B,97C 'allow':92C 'arbitrari':47B,104C 'attack':60B,106C 'authent':37B,93C 'chang':9A 'contact':66B,122C 'contain':84C 'crm':3A,29B,32B,81C 'custom':12A,43B,71B,100C,127C 'cve':14A,17A 'delet':53B,70B,114C,126C 'detail':67B,123C 'direct':87C 'do-open':55B,116C 'endpoint':58B,119C 'enumer':62B,108C 'get':51B,112C 'host':26B 'id':48B,63B,105C,109C 'insecur':86C 'let':35B 'object':88C 'open':57B,118C 'overwrit':68B,124C 'packag':20B 'pool':78B,134C 'public':77B,133C 'read':7A,65B,121C 'record':13A,44B,101C 'refer':89C 'releas':73B,129C 'sale':4A,22B,38B,94C 'sales-team':21B 'self':25B 'self-host':24B 'suppli':46B,103C 'team':23B 'updat':52B,113C 'user':5A,11A,39B,42B,95C,99C 'vulner':90C 'yshop':2A,28B,31B,80C 'yshop-crm':1A,27B,30B,79C","nicknames":[],"mitigations":[],"who_affected":"Deployments of yshop-crm up to and including 2.1.3 where sales-role users share one customer table and the endpoints do not check record ownership. Teams that run a patched version or do not use yshop-crm can skip it. Whether a given install has the flaw cannot be confirmed from the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111703","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111703","severity":null,"published_at":"2026-10-16T18:17:54+00:00","modified_at":"2026-10-16T20:17:22+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}