---
id: "CVE-2026-111703"
kind: "vulnerability"
aliases: ["CVE-2026-111703"]
title: "yshop-crm: sales users can read and change other users' customer records"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "sales-team", "self-hosted", "yshop-crm"]
not_affected_if: ["not-using-yshop-crm", "patched-version"]
published_at: "2026-10-16T18:17:54+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T04:01:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111703", "first_seen_at": "2026-10-23T21:57:13+00:00"}]
---

# yshop-crm: sales users can read and change other users' customer records

yshop-crm through 2.1.3 lets an authenticated sales user access other users' customer records by supplying arbitrary ids to the get, update, delete and do-open endpoints. An attacker can enumerate ids to read contact details, overwrite or delete customers, or release them into the public pool.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed yshop-crm version against `2.1.3` (unknown how the sources expect it to be read in your deployment)
- Review the customer get, update, delete and do-open endpoints for an ownership check on the record id (unknown which file or route names the sources expect)

## Fix

- Upgrade yshop-crm past `2.1.3` (unknown fixed version; the sources do not say)
- Until patched, restrict access to the customer endpoints to record owners at the application level or limit sales-user accounts

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111703

## From the sources

yshop-crm through 2.1.3 contains an insecure direct object reference vulnerability that allows authenticated sales users to access other users' customer records by supplying arbitrary ids. Attackers can enumerate ids against the get, update, delete and do-open endpoints to read contact details, overwrite or delete customers, or release them into the public pool.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_