Missing Authorization Vulnerability in Wukong AICRM

Wukong AICRM versions up to and including 20260610 are affected by a critical missing authorization vulnerability (CVE-2026-110207). The application fails to perform administrator-level permission checks on various administrative endpoints, including user, role, department, and agent management APIs. This flaw allows any authenticated user to interact with these sensitive functions. By sending a crafted POST request to the /managerUser/updateUser endpoint, an attacker can overwrite the administrator account's password and elevate their own privileges to the 'all' role. This vulnerability provides a straightforward path for unprivileged users to achieve full application administrative takeover. The vulnerability is highly exploitable, requiring only a valid standard user account to execute the administrative commands that lead to complete compromise of the AICRM instance.

Attack Chain

1. Attacker authenticates to the Wukong AICRM platform using a low-privileged user account.
2. Attacker performs discovery to identify administrative API endpoints such as /managerUser/updateUser.
3. Attacker crafts a malicious HTTP POST request targeting the /managerUser/updateUser administrative endpoint.
4. The request includes parameters designed to reset the password of the administrative account.
5. The server processes the request without validating if the sender possesses administrative authorization.
6. The application updates the administrator password to a known value.
7. Attacker updates their account role to the 'all' role via the same or subsequent administrative API calls.
8. Attacker logs in as the administrator to gain full control over the CRM data and system configuration.

Impact

Successful exploitation results in total administrative account takeover of the Wukong AICRM platform. This allows attackers to exfiltrate customer relationship data, modify system configurations, and manage user roles. Given the nature of CRM systems, this data often contains sensitive PII, business strategy, and client communication logs. Any instance of Wukong AICRM running version 20260610 or earlier is at risk.

Recommendation

Prioritized actions for security teams:

• Patch or upgrade Wukong AICRM instances immediately to a version released after 20260610 that addresses CVE-2026-110207.
• Deploy web server detection rules to monitor for unauthorized POST requests to /managerUser/updateUser from standard user sessions.
• Audit logs for successful password changes or privilege escalations occurring through administrative API endpoints.
• Monitor for suspicious activity originating from low-privileged accounts that attempt to access management-related URI paths.