CVE-2026-110208
HighCVSS 7.1Summary
Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated user to read the stored AI provider API key. Attackers can request GET /systemConfig/byType/ai for the cleartext key, or send a chosen apiUrl to /systemConfig/ai/test, forwarding the stored key to their host.
Risk Assessment
The risk includes exposure of sensitive API keys, potentially leading to unauthorized use of AI services and data security compromise.
Recommendation
It is recommended to immediately upgrade Wukong AICRM to a patched version and restrict access to /systemConfig endpoints to authorized administrators only.
Other vulnerabilities in Wukong AICRM
See all- CVE-2026-110207High
Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows any authenticated user to call user, role, department and agent administration APIs because no administrator check exists. Attackers can send POST requests to /managerUser/updateUser to reset the admin account's password and assign themselves the "all" role, achieving full administrator account takeover.
- CVE-2026-108689Medium
A missing authorization vulnerability in Wukong AICRM through 20260610 allows authenticated users to write into other users' AI chat sessions by supplying an arbitrary sessionId to POST /chat/send. Attackers can append messages to a victim's conversation and receive streamed assistant replies built from the victim's last 20 messages, disclosing conversation content.
Original NVD description (English source)
Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated user to read the stored AI provider API key. Attackers can request GET /systemConfig/byType/ai for the cleartext key, or send a chosen apiUrl to /systemConfig/ai/test, forwarding the stored key to their host.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS