Is CVE-2026-92459 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-92459?

CVE-2026-92459 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-92459

Description

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmCluesController receiveCustomer endpoint that allows authenticated back-office users to claim sales leads without proper permission checks. Attackers can invoke the lead-claim endpoint to reassign leads from other employees to themselves by overwriting the ownerUserId field, with no access logging or quota validation to prevent bulk lead theft.