yshop-crm through version 2.1.3 contains a missing authorization check on the CrmFlowController deleteFlowStep endpoint. The vulnerability, classified as CWE-862, allows any authenticated back‑office user to invoke the DELETE /admin-api/crm/flow/delete‑step API and remove approval workflow steps that govern critical business processes such as contract approval, receivable processing, and invoice finalization. By deleting these steps, an attacker can disrupt or divert essential business operations, potentially resulting in financial losses or compliance violations.

The affected product is yshop‑crm from the vendor guchengwuyue. All installations of yshop‑crm up to and including version 2.1.3 are vulnerable to this authorization bypass.

The CVSS score of 7.1 indicates moderate to high severity, and the EPSS score of less than 1% suggests a low likelihood of widespread exploitation at present. The vulnerability is not yet listed in the CISA KEV catalog. Exploitation requires only that the attacker has valid authenticated back-office credentials; with those, the attacker can delete arbitrary workflow steps without needing elevated administrative rights. The primary risk is therefore confined to environments where credentials are either compromised or granted to users with broader permissions, but once exploited it could significantly alter business process integrity.