CVE-2026-92463 yshop-crm through 2.1.3 Missing Authorization via Disabled Annotation on System User Listing
Authenticated back-office users can bypass authorization checks to enumerate all system users and their personal details.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-92463?
CVE-2026-92463 is a high-severity missing authorization vulnerability in guchengwuyue yshop-crm, published on 16 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
yshop-crm through 2.1.3 contains an authorization failure in the GET /admin-api/system/user/page endpoint where the @PreAuthorize annotation is commented out, allowing authenticated back-office users without system:user:list permission to enumerate all users. Attackers with valid back-office credentials and a role with data scope ALL can retrieve the complete user directory including login names, nicknames, departments, email addresses, mobile numbers, and last login information.
Weakness: CWE-862
Which versions are affected by CVE-2026-92463?
How do I fix CVE-2026-92463?
No fix has been published for CVE-2026-92463 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-92463 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-92463 exists.
Sources
Also known as GHSA-fxr9-cwrf-jj7v.