CVE-2026-92456
|
| |
|
|
Affected software |
REDIS |
|
|
|
yshop-crm through 2.1.3 fails to enforce authorization on the saveRedisSet and getRedisSet endpoints in CrmCustomerController, allowing any authenticated back-office user to read and modify installation-wide lead-allocation and customer auto-recycling policy. Attackers can invoke these endpoints to manipulate shared Redis keys controlling customer auto-recycling behavior, causing mass customer data deletion, disabling lead recycling, or blocking customer creation across the deployment. |
Link: |
| https://nvd.nist.gov/vuln/detail/CVE-2026-92456 |
