CVE-2026-110208

Awaiting Analysis Awaiting Analysis - Queue

Wukong AICRM Missing Authorization Exposes API Key

Publication date: 2026-10-13

Last updated on: 2026-10-14

Assigner: VulnCheck

Description

Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated user to read the stored AI provider API key. Attackers can request GET /systemConfig/byType/ai for the cleartext key, or send a chosen apiUrl to /systemConfig/ai/test, forwarding the stored key to their host.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110208

EUVD

EUVD-2026-99249

Affected Vendors & Products

Vendor	Product	Version / Range
WuKongOpenSource	Wukong	AICRM 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

CVE-2026-110208 is a missing authorization vulnerability in Wukong AICRM through version 20260610. It allows any authenticated user to read stored AI provider API keys in cleartext by requesting specific endpoints like GET /systemConfig/byType/ai or /systemConfig/ai/test with a chosen apiUrl.

Detection Guidance

Check for unauthorized access to /systemConfig/byType/ai or /systemConfig/ai/test endpoints. Use tools like curl to send GET requests to these paths while authenticated. Monitor logs for suspicious requests to these endpoints or unusual data exfiltration patterns.

Impact Analysis

An attacker with access can exfiltrate AI provider API keys, potentially leading to unauthorized use of AI services, data breaches, or further attacks on connected systems. They may also test AI connections using exposed credentials, risking additional unauthorized access.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to sensitive data. Under GDPR, unauthorized exposure of personal data may violate principles of data protection and user rights. HIPAA requires strict access controls for protected health information; this flaw allows any authenticated user to access stored AI provider API keys, potentially exposing encrypted or sensitive data.

Mitigation Strategies

Apply the latest patch or update to Wukong AICRM beyond version 20260610. Restrict access to sensitive endpoints by implementing proper authorization checks. Rotate all exposed AI provider API keys immediately if they were accessed.

Hi! I’m here to help you understand CVE-2026-110208. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70