Missing Authorization in Wukong AICRM Exposes Sensitive Data

CVE-2026-110208

What is CVE-2026-110208?

The Wukong AICRM platform prior to version 20260610 is susceptible to a missing authorization flaw in the /systemConfig controller. This vulnerability enables any authenticated user to access sensitive API keys used for AI provider integration. Attackers can exploit this flaw by performing a GET request to /systemConfig/byType/ai to retrieve the API key in cleartext, or by crafting an apiUrl to /systemConfig/ai/test to forward the API key to an external host. This exposure can lead to unauthorized access and control over AI provider functionalities, necessitating immediate action to mitigate risks.

References