CVE-2026-110207: Wukong AICRM through 20260610 Missing Authorization in User and Role Management APIs

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-13 · updated 2026-10-14
Weakness: CWE-862

Description

Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows any authenticated user to call user, role, department and agent administration APIs because no administrator check exists. Attackers can send POST requests to /managerUser/updateUser to reset the admin account's password and assign themselves the "all" role, achieving full administrator account takeover.

Affected products

WuKongOpenSource Wukong AICRM: through 20260610

References

https://github.com/WuKongOpenSource/Wukong-AICRM
https://github.com/WuKongOpenSource/Wukong-AICRM/blob/20260610/backend/src/main/java/com/kakarote/ai_crm/config/SecurityConfig.java#L66-L84
https://github.com/WuKongOpenSource/Wukong-AICRM/blob/20260610/backend/src/main/java/com/kakarote/ai_crm/controller/ManagerUserController.java#L45-L72
https://github.com/WuKongOpenSource/Wukong-AICRM/blob/20260610/backend/src/main/java/com/kakarote/ai_crm/service/impl/ManageUserServiceImpl.java#L181-L237
https://github.com/WuKongOpenSource/Wukong-AICRM/blob/20260610/backend/src/main/java/com/kakarote/ai_crm/service/impl/ManagerRoleServiceImpl.java#L224-L243
https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/wukong-aicrm-api-wide-missing-authorization
https://www.vulncheck.com/advisories/wukong-aicrm-through-20260610-missing-authorization-in-user-and-role-management-apis

Get alerted when CVE-2026-110207 or the next vulnerability affects your stack