https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-19T08:17:26.784626+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-109171 fkie_cve-2026-109171 2026-10-19T08:17:26.788482+00:00

yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject contracts by calling POST /admin-api/crm/contract/check. Because CrmContractController lacks @PreAuthorize and approver checks are commented out, attackers can approve contracts to alter customer deal and purchase data or reject them to return products to stock.

 https://db.gcve.eu/vuln/ghsa-h7m8-pw8h-m438 GHSA-h7m8-pw8h-m438 2026-10-19T08:17:26.788591+00:00

yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject contracts by calling POST /admin-api/crm/contract/check. Because CrmContractController lacks @PreAuthorize and approver checks are commented out, attackers can approve contracts to alter customer deal and purchase data or reject them to return products to stock.