CVE-2026-110207
Wukong AICRM through 20260610 Missing Authorization in User and Role Management APIs
WuKongOpenSource Wukong AICRM
CVSS
8.7HighExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 14 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.45%Chance of exploitation activity in the next 30 days, higher than 37% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows any authenticated user to call user, role, department and agent administration APIs because no administrator check exists. Attackers can send POST requests to /managerUser/updateUser to reset the admin account's password and assign themselves the "all" role, achieving full administrator account takeover.
Text from CVE List
Affected versions 1
- Wukong AICRMaffected: all versions through 20260610CVE List
References 7
- hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/wukong-aicrm-api-wide-missing-authorizationAdvisoryvia CVE List
- github.com/WuKongOpenSource/Wukong-AICRM/blob/20260610/backend/src/main/java/com/kakarote/ai_crm/config/SecurityConfig.java#L66-L84Advisoryvia CVE List
- vulncheck.com/advisories/wukong-aicrm-through-20260610-missing-authorization-in-user-and-role-management-apisAdvisoryvia CVE List
- github.com/WuKongOpenSource/Wukong-AICRM/blob/20260610/backend/src/main/java/com/kakarote/ai_crm/service/impl/ManageUserServiceImpl.java#L181-L237Referencevia CVE List
- github.com/WuKongOpenSource/Wukong-AICRM/blob/20260610/backend/src/main/java/com/kakarote/ai_crm/controller/ManagerUserController.java#L45-L72Referencevia CVE List
- github.com/WuKongOpenSource/Wukong-AICRM/blob/20260610/backend/src/main/java/com/kakarote/ai_crm/service/impl/ManagerRoleServiceImpl.java#L224-L243Referencevia CVE List
- github.com/WuKongOpenSource/Wukong-AICRMReferencevia CVE List