CVE-2026-110207 in Wukong AICRM
Summary
by MITRE • 10/13/2026
Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows any authenticated user to call user, role, department and agent administration APIs because no administrator check exists. Attackers can send POST requests to /managerUser/updateUser to reset the admin account's password and assign themselves the "all" role, achieving full administrator account takeover.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified in Wukong AICRM versions up through 20260610 represents a critical failure in access control mechanisms, specifically classified under CWE-862 Missing Authorization. This flaw stems from the absence of administrative privilege verification within several core application programming interfaces responsible for managing users, roles, departments, and agents. In a properly secured system, endpoints that modify high-level configuration or user attributes must validate that the requesting entity possesses elevated privileges, typically an administrator role. However, in this implementation, these sensitive operations are accessible to any authenticated session regardless of its associated permission level. This architectural oversight effectively neutralizes the intended separation between standard users and administrators, allowing lower-privileged accounts to execute commands reserved exclusively for system owners or security officers.
The operational impact of this vulnerability is severe, as it enables a complete compromise of administrative control over the application environment. An attacker who has obtained valid credentials for any user account can exploit this flaw by sending specifically crafted POST requests to endpoints such as /managerUser/updateUser. By manipulating the parameters within these requests, an adversary can reset the password associated with the primary administrator account and simultaneously reassign their own session or a new account to possess the all role. This action grants the attacker unrestricted access to all features of the platform, including sensitive data processing, system configuration changes, and potential integration points that may expose further network vulnerabilities. The ability to escalate privileges in this manner transforms a low-impact authentication breach into a high-severity administrative takeover, potentially leading to significant business disruption, data exfiltration, or lateral movement within connected networks.
From the perspective of threat modeling, this vulnerability aligns with MITRE ATT&CK technique T1078 Valid Accounts and specifically T1098 Unauthorized Access via API Endpoints when considering the exploitation vector. The attack path is straightforward for any actor capable of authenticating to the application, requiring no complex exploit chain or zero-day dependencies beyond standard HTTP request manipulation tools. This simplicity increases the likelihood of automated scanning and widespread exploitation in environments where Wukong AICRM is deployed without adequate network segmentation or additional access control layers such as Web Application Firewalls configured with strict role-based filtering rules.
To mitigate this risk, immediate remediation should focus on implementing robust server-side authorization checks for all administrative endpoints. Developers must ensure that every API call intended for user management verifies the current session's privileges against a centralized policy engine before processing any state-changing requests. Additionally, input validation should be reinforced to prevent parameter tampering that could alter role assignments or password fields unexpectedly. Beyond code-level fixes, organizations should enforce strict network segmentation to isolate administrative interfaces from general user traffic and implement multi-factor authentication for all privileged accounts to reduce the impact of credential theft. Regular security audits focusing on broken access control patterns are essential to detect similar oversights in other modules before they can be exploited by malicious actors seeking full system dominance.