Wukong AICRM vulnerabilities

2 known vulnerabilities in Wukong AICRM from WuKongOpenSource. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.1 High severity

  Wukong AICRM: Missing Authorization

  CVE-2026-110208Oct 13, 2026WuKongOpenSource

  Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated user to read the stored AI provider API key. Attackers can request GET /systemConfig/byType/ai for the cleartext key, or

• 8.8 High severity

  Wukong AICRM: Missing Authorization

  CVE-2026-110207Oct 13, 2026WuKongOpenSource

  Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows any authenticated user to call user, role, department and agent administration APIs because no administrator check exists. Attackers can send POST requests to /managerUser