yshop-crm through 2.1.3 contains an insecure direct object reference that allows an authenticated sales user to retrieve, update, or delete any customer record by supplying arbitrary identifiers. Attackers can enumerate valid ids against the get, update, delete and do-open endpoints, resulting in unauthorized disclosure of contact details, alteration of records, or deletion of customers, thereby compromising the confidentiality, integrity, and availability of customer data.

The affected vendor is Guchengwuyue and the product is yshop-crm. All releases up to and including version 2.1.3 are vulnerable, as the issue originates in the customer controller and service layers of that release.

The CVSS score of 5.3 indicates a moderate severity vulnerability. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. Because the flaw requires authenticated access by a sales user, an attacker must have valid credentials or be able to compromise an existing sales account. Once authenticated, enumeration of arbitrary customer ids is trivial, and the attacker can read, modify, or delete records without further privilege escalation.