{"id":"CVE-2026-110207","published":"2026-10-13T19:18:44.337","lastModified":"2026-10-14T17:18:24.100","description":"Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows any authenticated user to call user, role, department and agent administration APIs because no administrator check exists. Attackers can send POST requests to /managerUser/updateUser to reset the admin account's password and assign themselves the \"all\" role, achieving full administrator account takeover.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://github.com/WuKongOpenSource/Wukong-AICRM","tags":[]},{"url":"https://github.com/WuKongOpenSource/Wukong-AICRM/blob/20260610/backend/src/main/java/com/kakarote/ai_crm/config/SecurityConfig.java#L66-L84","tags":[]},{"url":"https://github.com/WuKongOpenSource/Wukong-AICRM/blob/20260610/backend/src/main/java/com/kakarote/ai_crm/controller/ManagerUserController.java#L45-L72","tags":[]},{"url":"https://github.com/WuKongOpenSource/Wukong-AICRM/blob/20260610/backend/src/main/java/com/kakarote/ai_crm/service/impl/ManageUserServiceImpl.java#L181-L237","tags":[]},{"url":"https://github.com/WuKongOpenSource/Wukong-AICRM/blob/20260610/backend/src/main/java/com/kakarote/ai_crm/service/impl/ManagerRoleServiceImpl.java#L224-L243","tags":[]},{"url":"https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/wukong-aicrm-api-wide-missing-authorization","tags":[]},{"url":"https://www.vulncheck.com/advisories/wukong-aicrm-through-20260610-missing-authorization-in-user-and-role-management-apis","tags":[]}],"exploitRefs":[{"url":"https://github.com/WuKongOpenSource/Wukong-AICRM","tags":[]},{"url":"https://github.com/WuKongOpenSource/Wukong-AICRM/blob/20260610/backend/src/main/java/com/kakarote/ai_crm/config/SecurityConfig.java#L66-L84","tags":[]},{"url":"https://github.com/WuKongOpenSource/Wukong-AICRM/blob/20260610/backend/src/main/java/com/kakarote/ai_crm/controller/ManagerUserController.java#L45-L72","tags":[]},{"url":"https://github.com/WuKongOpenSource/Wukong-AICRM/blob/20260610/backend/src/main/java/com/kakarote/ai_crm/service/impl/ManageUserServiceImpl.java#L181-L237","tags":[]},{"url":"https://github.com/WuKongOpenSource/Wukong-AICRM/blob/20260610/backend/src/main/java/com/kakarote/ai_crm/service/impl/ManagerRoleServiceImpl.java#L224-L243","tags":[]}],"hasPoc":true,"ai":{"summary":"A missing authorization check in Wukong AICRM allows any authenticated user to perform administrative functions like resetting admin passwords and assigning admin roles, leading to full system takeover. This vulnerability exists because the application fails to verify if a user has administrative privileges before allowing access to sensitive management APIs.","exploitability":"The exploit is relatively straightforward requiring only an authenticated session and the ability to send POST requests to specific endpoints, with no additional prerequisites for exploitation.","blast_radius":"An attacker could gain complete administrative control over the system, potentially compromising all user data, roles, departments, and agents, with minimal effort once they have an authenticated account.","remediation":"Disable access to the /managerUser/updateUser endpoint until a patch is applied, or restrict this endpoint to only be accessible from internal network sources.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["authorization","privilege-escalation","web"],"model":"garnet-coder","analyzedAt":"2026-10-18T09:53:47.179Z"}}