https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-04T21:52:32.075951+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-92459 fkie_cve-2026-92459 2026-10-04T21:52:32.078235+00:00

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmCluesController receiveCustomer endpoint that allows authenticated back-office users to claim sales leads without proper permission checks. Attackers can invoke the lead-claim endpoint to reassign leads from other employees to themselves by overwriting the ownerUserId field, with no access logging or quota validation to prevent bulk lead theft.

 https://vulnerability.circl.lu/vuln/ghsa-qwxr-xhwf-5r52 GHSA-qwxr-xhwf-5r52 2026-10-04T21:52:32.078326+00:00

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmCluesController receiveCustomer endpoint that allows authenticated back-office users to claim sales leads without proper permission checks. Attackers can invoke the lead-claim endpoint to reassign leads from other employees to themselves by overwriting the ownerUserId field, with no access logging or quota validation to prevent bulk lead theft.