Missing Authorization Vulnerability in Wukong AICRM by WuKong

CVE-2026-110207

What is CVE-2026-110207?

The Wukong AICRM platform, up to version 20260610, exhibits a critical missing authorization vulnerability. This flaw permits any authenticated user to interact with sensitive user, role, department, and agent administration APIs without necessary administrator checks. Attackers can exploit this vulnerability by sending POST requests to the /managerUser/updateUser endpoint, allowing them to reset the passwords of admin accounts and elevate their privileges by assigning themselves the 'all' role. This could lead to unauthorized full access to the system, compromising sensitive data and functionalities.

References