---
id: CVE-2026-111703
title: yshop-crm through 2.1.3 IDOR via CRM customer by-id endpoints
summary: >-
  yshop-crm through 2.1.3 contains an insecure direct object reference
  vulnerability that allows authenticated sales users to access other users'
  customer records by supplying arbitrary ids. Attackers can enumerate ids
  against the get, upd…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'
cvssSource: cna
cwe:
  - CWE-639
vendor: guchengwuyue
product: yshop-crm
affected:
  - yshop-crm <= 2.1.3
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T19:50:53.802860Z'
exploitAvailable: true
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:51:05.638Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111703'
references:
  - url: 'https://hackmd.io/@hieuPenguinnn/yshop-crm-customer-idor-and-missing-authz'
  - url: >-
      https://github.com/guchengwuyue/yshop-crm/blob/a93846584877ed5f6ffcaeeb7182d1707a21a221/yshop-crm/yshop-module-crm/yshop-module-crm-biz/src/main/java/co/yixiang/yshop/module/crm/service/crmcustomer/CrmCustomerServiceImpl.java#L105-L203
  - url: >-
      https://github.com/guchengwuyue/yshop-crm/blob/a93846584877ed5f6ffcaeeb7182d1707a21a221/yshop-crm/yshop-module-crm/yshop-module-crm-biz/src/main/java/co/yixiang/yshop/module/crm/controller/admin/crmcustomer/CrmCustomerController.java#L46-L87
  - url: >-
      https://www.vulncheck.com/advisories/yshop-crm-through-2.1.3-idor-via-crm-customer-by-id-endpoints
    label: >-
      VulnCheck Advisory: yshop-crm through 2.1.3 IDOR via CRM customer by-id
      endpoints
tags:
  - cve.org
  - exploit-available
ingestedAt: '2026-10-16T18:43:08.653Z'
---

## Overview

yshop-crm through 2.1.3 contains an insecure direct object reference vulnerability that allows authenticated sales users to access other users' customer records by supplying arbitrary ids. Attackers can enumerate ids against the get, update, delete and do-open endpoints to read contact details, overwrite or delete customers, or release them into the public pool.

## Affected

- `yshop-crm <= 2.1.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.