Description
yshop-crm through 2.1.3 contains an authorization failure in the GET /admin-api/system/user/page endpoint where the @PreAuthorize annotation is commented out, allowing authenticated back-office users without system:user:list permission to enumerate all users. Attackers with valid back-office credentials and a role with data scope ALL can retrieve the complete user directory including login names, nicknames, departments, email addresses, mobile numbers, and last login information.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| guchengwuyue | yshop-crm | ≤ 2.1.3 | — |
References
- Reporter proof of concept: user-directory enumeration via /system/user/page exploit
- @PreAuthorize commented out on getUserPage at 2.1.3 technical-description
- getUserPage applies no caller scope and carries no DataPermission annotation technical-description
- dept data-permission rule adds no predicate when the caller role has data scope ALL technical-description
- Maven revision property showing the affected tree is version 2.1.3 technical-description
- yshop-crm source repository product
- VulnCheck Advisory: yshop-crm through 2.1.3 Missing Authorization via Disabled Annotation on System User Listing third-party-advisory