CVE-2026-110207
HighCVSS 8.8Summary
Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows any authenticated user to call user, role, department and agent administration APIs because no administrator check exists. Attackers can send POST requests to /managerUser/updateUser to reset the admin account's password and assign themselves the "all" role, achieving full administrator account takeover.
Risk Assessment
The risk includes full administrator account takeover, leading to complete loss of system control and compromise of all data.
Recommendation
It is recommended to immediately upgrade Wukong AICRM to a patched version and implement administrator privilege checks for all administrative endpoints.
Other vulnerabilities in Wukong AICRM
See all- CVE-2026-110208High
Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated user to read the stored AI provider API key. Attackers can request GET /systemConfig/byType/ai for the cleartext key, or send a chosen apiUrl to /systemConfig/ai/test, forwarding the stored key to their host.
- CVE-2026-108689Medium
A missing authorization vulnerability in Wukong AICRM through 20260610 allows authenticated users to write into other users' AI chat sessions by supplying an arbitrary sessionId to POST /chat/send. Attackers can append messages to a victim's conversation and receive streamed assistant replies built from the victim's last 20 messages, disclosing conversation content.
Original NVD description (English source)
Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows any authenticated user to call user, role, department and agent administration APIs because no administrator check exists. Attackers can send POST requests to /managerUser/updateUser to reset the admin account's password and assign themselves the "all" role, achieving full administrator account takeover.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS