CVE-2026-110208: Wukong AICRM through 20260610 Missing Authorization in System Configuration APIs Exposes Stored AI Provider Keys
Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated user to read the stored AI provider API key. Attackers can request GET /systemConfig/byType/ai for the cleartext key, or send a chosen apiUrl to /systemConfig/ai/test, forwarding the stored key to their host.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated user can exploit it. The affected endpoints do not enforce the authorization needed to protect the stored AI provider API key.
What access does an attacker need before exploiting it?
The attacker needs valid authentication to the application. No user interaction is required, and exploitation can be performed over the network.
How can the stored key be exposed?
An authenticated user can request GET /systemConfig/byType/ai to retrieve the cleartext AI provider key. They can also submit an attacker-controlled apiUrl to /systemConfig/ai/test, causing the application to forward the stored key to a host they control.
Which versions are identified as affected?
Wukong AICRM through 20260610 is identified as affected.