Wukong AICRM: Missing authorization in user and role management APIs
Summary
Wukong AICRM through version 20260610 does not check for administrator rights on its user, role, department and agent management APIs. Any authenticated user can send POST requests, for example to /managerUser/updateUser, to reset the admin account's password and assign themselves the "all" role. This leads to full administrator account takeover and control of the CRM data.
Affected
- Wukong AICRM versions 0 through 20260610 (CNA: VulnCheck; default configuration unaffected per CNA record)
- Exposure requires a valid low-privilege account (any login with access rights)
Fixed in
Unknown. No patched release was confirmed. A commit reference exists in OSV (cdd1fbc3187d2bcbf2cdf2be7d50c988959da356), but its contents and release status are unverified.
Workaround
- Restrict network access to the application to trusted users or VPN; do not expose it directly to the internet
- Block or restrict access to user and role management endpoints at a reverse proxy or WAF (test first)
- Restrict self-registration and disable unused accounts
Exploitation
- No confirmed exploitation in the wild; no CISA KEV entry found
- CISA SSVC: exploitation status 'poc', automatable: no, technical impact: total
- A public proof of concept is claimed by a third party but could not be verified
Our recommendation
- Identify all Wukong AICRM instances and their versions
- Restrict access to the admin APIs and limit who holds login accounts
- Audit the admin account, recent password changes and assignments of the "all" role; look for unknown users, agents or departments
- Rotate the admin password and AI provider keys if compromise is suspected
- Track the vendor's fix and update as soon as a confirmed patched release is available
- Check that the installation is licensed for commercial use, as required by the vendor's terms
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- SecurityConfig.java (tag 20260610) github.com
- ManagerUserController.java (tag 20260610) github.com
- ManageUserServiceImpl.java (tag 20260610) github.com
- ManagerRoleServiceImpl.java (tag 20260610) github.com
- HackMD write-up hackmd.io
- Wukong AICRM GitHub repository github.com
- CVE-2026-110207 on Vulners vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:21.
Original description (NVD)
Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows any authenticated user to call user, role, department and agent administration APIs because no administrator check exists. Attackers can send POST requests to /managerUser/updateUser to reset the admin account's password and assign themselves the "all" role, achieving full administrator account takeover.
NVD references (7)
- https://github.com/WuKongOpenSource/Wukong-AICRM
- https://github.com/WuKongOpenSource/Wukong-AICRM/blob/20260610/backend/src/main/java/com/kakarote/ai_crm/conf…
- https://github.com/WuKongOpenSource/Wukong-AICRM/blob/20260610/backend/src/main/java/com/kakarote/ai_crm/cont…
- https://github.com/WuKongOpenSource/Wukong-AICRM/blob/20260610/backend/src/main/java/com/kakarote/ai_crm/serv…
- https://github.com/WuKongOpenSource/Wukong-AICRM/blob/20260610/backend/src/main/java/com/kakarote/ai_crm/serv…
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/wukong-aicrm-api-wide-missing-authorization
- https://www.vulncheck.com/advisories/wukong-aicrm-through-20260610-missing-authorization-in-user-and-role-man…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.