Insecure Direct Object Reference in Yshop-CRM Allows Unauthorized Access to Customer Records
CVE-2026-111703

5.3MEDIUM

Key Information:

Vendor: Guchengwuyue
Status: Yshop-crm
Vendor: CVE Published:; 16 October 2026

🔔 Create Guchengwuyue Vulnerability Alert

What is CVE-2026-111703?

Yshop-CRM versions up to 2.1.3 are susceptible to an insecure direct object reference vulnerability. This flaw allows authenticated sales users to access other users' customer records by manipulating user IDs. By exploiting this vulnerability, attackers can enumerate user IDs against various endpoints, including get, update, delete, and do-open, potentially exposing sensitive customer contact details, facilitating unauthorized modifications, or even deleting customer records. This presents significant risks to data privacy and integrity.