The vulnerability allows any authenticated back‑office user to approve or reject contracts via the POST /admin-api/crm/contract/check endpoint because the controller lacks proper authorization checks. An attacker can alter customer deal and purchase records by approving a contract they should not, or trigger a return of products to stock by rejecting a contract, effectively manipulating inventory data and financial records.

The issue is present in the open‑source yshop‑crm module from vendor guchengwuyue, affecting all deployments of version 2.1.3 and any earlier releases that have not applied later updates. Systems running this module without the patch remain vulnerable.

The CVSS score of 5.3 indicates a moderate severity, and the EPSS score is not available, suggesting no known widespread exploitation yet. The vulnerability is not listed in the CISA KEV catalogue. Exploitation requires an authenticated back‑office session; an attacker must obtain or compromise valid credentials to access the API. Once authenticated, the missing authorization allows the endpoint to be called without further checks, making the attack path straightforward for any compromised or weakly protected user account.