CVE-2026-108689
Received Received - Intake

Authenticated Session Write in Wukong AICRM

Publication date: 2026-10-11

Last updated on: 2026-10-11

Assigner: VulnCheck

Description
Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows authenticated users to write into other users' AI chat sessions by supplying an arbitrary sessionId to POST /chat/send. Attackers can append messages to a victim's conversation and receive streamed assistant replies built from the victim's last 20 messages, disclosing conversation content.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-11
Last Modified
2026-10-11
Generated
2026-10-11
AI Q&A
2026-10-11
EPSS Evaluated
N/A
NVD
CVE-2026-108689
EUVD
EUVD-2026-96712

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
WuKongOpenSource Wukong AICRM 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-108689 is a missing authorization vulnerability in Wukong AICRM through 20260610. Authenticated users can write messages into other users' AI chat sessions by providing an arbitrary sessionId to the POST /chat/send endpoint. Attackers can append messages to a victim's conversation and receive AI responses based on the victim's last 20 messages, potentially exposing sensitive content.

Detection Guidance

To detect this vulnerability, monitor HTTP POST requests to /chat/send endpoints for unusual sessionId parameters. Check for requests where the sessionId does not match the authenticated user's session. Review logs for messages appended to sessions not owned by the sender. Use network traffic analysis tools like Wireshark or tcpdump to inspect POST /chat/send requests for arbitrary sessionId values.

Impact Analysis

This vulnerability allows attackers to inject unauthorized messages into your AI chat sessions, manipulate session titles, consume your AI quotas, and receive AI responses built from your last 20 messages. This could lead to exposure of sensitive business or personal data discussed in your chats.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's confidentiality requirements. Exposure of personal or health-related information in chat sessions may result in compliance breaches, legal penalties, and reputational damage.

Mitigation Strategies

Immediately update Wukong AICRM to the latest patched version. Implement strict session ownership validation for POST /chat/send requests. Restrict access to the /chat/send endpoint to authorized users only. Monitor for unauthorized sessionId manipulation attempts in logs. Consider disabling AI chat features temporarily if patches are unavailable.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108689. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart