HIGH 8.7 NVD
CVE-2026-110207
Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows any authenticated user to call user, role, department and agent adminis
Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows any authenticated user to call user, role, department and agent administration APIs because no administrator check exists. Attackers can send POST requests to /managerUser/updateUser to reset the admin account's password and assign themselves the "all" role, achieving full administrator account takeover.
References
- https://github.com/WuKongOpenSource/Wukong-AICRM
- https://github.com/WuKongOpenSource/Wukong-AICRM/blob/20260610/backend/src/main/java/com/k
- https://github.com/WuKongOpenSource/Wukong-AICRM/blob/20260610/backend/src/main/java/com/k
- https://github.com/WuKongOpenSource/Wukong-AICRM/blob/20260610/backend/src/main/java/com/k
- https://github.com/WuKongOpenSource/Wukong-AICRM/blob/20260610/backend/src/main/java/com/k
This high severity vulnerability with a CVSS score of 8.7 was published on 2026-10-13 via NVD.
vulnfeed aggregates 14602 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.