CVE-2026-110207
Awaiting Analysis Awaiting Analysis - Queue

Authentication Bypass in Wukong AICRM Leading to Admin Takeover

Publication date: 2026-10-13

Last updated on: 2026-10-14

Assigner: VulnCheck

Description
Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows any authenticated user to call user, role, department and agent administration APIs because no administrator check exists. Attackers can send POST requests to /managerUser/updateUser to reset the admin account's password and assign themselves the "all" role, achieving full administrator account takeover.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-14
Generated
2026-10-19
AI Q&A
2026-10-14
EPSS Evaluated
2026-10-18
NVD
CVE-2026-110207
EUVD
EUVD-2026-99248

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
WuKongOpenSource Wukong AICRM 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-110207 is a missing authorization vulnerability in Wukong AICRM through version 20260610. It allows any authenticated user to perform administrative actions without proper checks. Attackers can exploit this by sending POST requests to endpoints like /managerUser/updateUser to reset admin passwords and assign themselves the 'all' role, leading to full account takeover.

Detection Guidance

Check for unauthorized POST requests to /managerUser/updateUser endpoints. Monitor for unusual admin password resets or role assignments. Inspect logs for requests from non-admin users to administrative functions.

Impact Analysis
  • Full administrator account takeover by resetting passwords and assigning admin roles.
  • Unauthorized access to sensitive data like chat transcripts, schedules, and tasks of other users.
  • Exfiltration of stored AI provider API keys through configuration endpoints.
  • Server-side request forgery (SSRF) allowing redirection of AI traffic to attacker-controlled servers.
  • Creation of persistent accounts with elevated privileges for ongoing access.
Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control. GDPR mandates strict authorization and data protection measures, while HIPAA requires safeguards for sensitive health data. The lack of role-based access control and unauthorized data access risks non-compliance with these standards.

Mitigation Strategies

Apply the latest patch from Wukong AICRM. Implement strict RBAC checks in SecurityConfig.java. Disable the /managerUser/updateUser endpoint if not critical. Rotate all admin passwords immediately.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110207. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart