CVE-2026-108689 in Wukong AICRM
Summary
by MITRE • 10/11/2026
Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows authenticated users to write into other users' AI chat sessions by supplying an arbitrary sessionId to POST /chat/send. Attackers can append messages to a victim's conversation and receive streamed assistant replies built from the victim's last 20 messages, disclosing conversation content.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in Wukong AICRM versions up through 20260610 represents a critical failure in access control mechanisms within the application's chat functionality. Specifically, this is an Insecure Direct Object Reference (IDOR) issue categorized under CWE-639, which involves authorization bypass via predictable or arbitrary resource identifiers. The core technical flaw lies in the POST /chat/send endpoint, where the server fails to validate that the sessionId provided by the authenticated user corresponds exclusively to a chat session owned by that same user. Instead of binding the session identifier strictly to the active authentication context, the application trusts the client-supplied parameter without performing sufficient backend authorization checks. This design oversight allows any logged-in user to manipulate the state of other users' interactions simply by substituting their own valid sessionId with an arbitrary one belonging to a different account.
From an operational perspective, this vulnerability enables significant data leakage and potential manipulation of AI-driven workflows. An attacker can inject malicious or misleading prompts into another user's conversation history. Because the system is designed to generate assistant replies based on the context of recent interactions, specifically the last twenty messages in the session, the injected content directly influences the output generated by the artificial intelligence model. This creates a scenario where an attacker not only gains visibility into sensitive information contained within the victim's chat logs but also actively alters the trajectory of those conversations. The streamed responses returned to the attacker are derived from the victim's actual data and context, effectively turning the AI assistant into a conduit for exfiltrating proprietary or personal details that were never intended to be shared with third parties.
The impact extends beyond simple information disclosure. By appending messages to a victim's session, an attacker can perform prompt injection attacks against the underlying large language model using the victim's credentials and context. This could lead to the generation of harmful content, false information, or actions that compromise the integrity of decisions made based on those AI responses. Furthermore, because the vulnerability relies on authenticated access, it is particularly dangerous in multi-tenant environments where users may trust each other implicitly but lack awareness of such cross-session manipulation capabilities. The ability to read streamed replies means that even if direct database access is restricted, the attacker can reconstruct significant portions of private dialogues by observing how the system responds to their injected inputs within another user's active session.
Mitigation strategies must focus on implementing robust authorization checks at the application layer. Developers should ensure that every request involving a resource identifier, such as a sessionId, undergoes strict validation against the identity of the authenticated user making the request. This typically involves querying the database or session store to verify ownership before processing any write operations like sending messages. Additionally, employing UUIDs for session identifiers can reduce the risk associated with predictable IDs, although it does not replace the need for explicit authorization checks. Input validation should also be applied to ensure that sessionId parameters are well-formed and belong to valid sessions within the system's lifecycle. Regular security audits focusing on broken access control patterns, aligned with OWASP Top 10 guidelines, are essential to detect and remediate such flaws before they can be exploited in production environments.