CVE-2026-110207: Wukong AICRM through 20260610 Missing Authorization in User and Role Management APIs
Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows any authenticated user to call user, role, department and agent administration APIs because no administrator check exists. Attackers can send POST requests to /managerUser/updateUser to reset the admin account's password and assign themselves the "all" role, achieving full administrator account takeover.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Wukong AICRM user can exploit it. The affected administration APIs lack an administrator authorization check, so a low-privileged account is sufficient.
What access can an attacker obtain?
An attacker can reset the administrator account password through /managerUser/updateUser and assign themselves the "all" role. This results in full administrator account takeover.
Which administrative functions are exposed?
The exposed APIs include administration functions for users, roles, departments, and agents. The vulnerability affects Wukong AICRM through version 20260610.