Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
CVE-2026-110207: Wukong AICRM lets any user gain admin rights
CVE-2026-110207 · published today
Summary
The Wukong AICRM system lets any logged‑in user change user, role, department and agent settings because it does not verify administrator privileges. An attacker could reset the admin password and assign themselves full control. Apply the vendor's update or patch and restrict access to these management functions immediately.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| wukongopensource | wukong aicrm | <= 20260610 |
Original advisory text
Wukong AICRM through 20260610 Missing Authorization in User and Role Management APIs
Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows any authenticated user to call user, role, department and agent administration APIs because no administrator check exists. Attackers can send POST requests to /managerUser/updateUser to reset the admin account's password and assign themselves the "all" role, achieving full administrator account takeover.
References
- https://github.com/WuKongOpenSource/Wukong-AICRM Product
- https://github.com/WuKongOpenSource/Wukong-AICRM/blob/20260610/backend/src/main/... Third Party Advisory
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/wukong-aicrm-api-wide-missing-authoriz... Vendor Advisory
- https://github.com/WuKongOpenSource/Wukong-AICRM/blob/20260610/backend/src/main/... Third Party Advisory
- https://github.com/WuKongOpenSource/Wukong-AICRM/blob/20260610/backend/src/main/... Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-1102... Vendor Advisory
- https://github.com/WuKongOpenSource/Wukong-AICRM/blob/20260610/backend/src/main/... Third Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-110207 Vendor Advisory
- https://www.vulncheck.com/advisories/wukong-aicrm-through-20260610-missing-autho... Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Severity
9.4
Critical
Type
CWE-862Missing Authorization
Timeline
Published13 Oct 2026
Updated14 Oct 2026
First seen13 Oct 2026
Track software like this
Free during beta