yshop-crm through 2.1.3 contains a missing authorization flaw that permits any authenticated back‑office user to approve or reject invoices via the POST /admin-api/crm/invoice/check endpoint. The CrmInvoiceController handler lacks security annotations and the code that verifies the requesting user is the designated approver is commented out, allowing an attacker to supply any invoice ID and manipulate approval status. This flaw can result in financial mis‑recording, fraudulent invoicing and unauthorized transaction processing.

The vulnerability affects the yshop-crm product by guchengwuyue. All releases up to and including version 2.1.3 are impacted. No later versions have been identified as fixed in the data provided.

The CVSS score of 5.3 indicates a moderate severity vulnerability. EPSS information is not available, but the flaw is not listed in CISA’s KEV catalog. The attack requires an authenticated back‑office account, meaning internal or compromised credentials are needed. Once authenticated, an attacker can modify invoice approvals without further checks, potentially leading to financial loss or regulatory non‑compliance. Given the moderate score and internal nature, the risk is substantial for organizations that rely on accurate invoice approval workflows.