CVE-2026-108689
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
A missing authorization vulnerability in Wukong AICRM through 20260610 allows authenticated users to write into other users' AI chat sessions by supplying an arbitrary sessionId to POST /chat/send. Attackers can append messages to a victim's conversation and receive streamed assistant replies built from the victim's last 20 messages, disclosing conversation content.
Risk Assessment
Risk of breach of user conversation confidentiality and potential manipulation of chat content, leading to misinformation and loss of trust.
Recommendation
Update Wukong AICRM to the patched version. Additionally, implement session-level access control so users can only write to their own sessions.
Other vulnerabilities in Wukong AICRM
See all- CVE-2026-110208High
Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated user to read the stored AI provider API key. Attackers can request GET /systemConfig/byType/ai for the cleartext key, or send a chosen apiUrl to /systemConfig/ai/test, forwarding the stored key to their host.
- CVE-2026-110207High
Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows any authenticated user to call user, role, department and agent administration APIs because no administrator check exists. Attackers can send POST requests to /managerUser/updateUser to reset the admin account's password and assign themselves the "all" role, achieving full administrator account takeover.
Original NVD description (English source)
Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows authenticated users to write into other users' AI chat sessions by supplying an arbitrary sessionId to POST /chat/send. Attackers can append messages to a victim's conversation and receive streamed assistant replies built from the victim's last 20 messages, disclosing conversation content.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS