yshop‑crm through version 2.1.3 contains a missing authorization failure that allows any authenticated back‑office user to approve or reject receivables via the POST /admin-api/crm/contract-receivables/check endpoint. The handler lacks an @PreAuthorize annotation and the service layer approval checks are commented out, so attackers can approve records by id, inflate the contract return_money field, and forge approval logs. This flaw enables an attacker to alter financial data and records without the proper subject‑matter authority, potentially leading to fraudulent transactions and compromised audit trails.

The vulnerability affects the Guchengwuyue yshop‑crm application up through version 2.1.3. Any installation of yshop‑crm 2.1.3 or older that has not been patched is potentially susceptible.

The CVSS score of 5.3 indicates a moderate risk; the EPSS score is unavailable and the issue is not listed in CISA KEV. Attackers would need to be an authenticated back‑office user, which means they already possess legitimate credentials. Once authenticated, the attacker can simply send a crafted POST request to the endpoint and bypass the missing authorization to approve or reject a receivable record. The impact is limited to data integrity and auditability rather than remote code execution, but the ability to manipulate financial records can have significant business and regulatory repercussions.