{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3awukongaicrm/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:wukong:aicrm:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-110207"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["AICRM (\u003c= 20260610)"],"_cs_severities":["high"],"_cs_tags":["web-application","privilege-escalation","auth-bypass"],"_cs_type":"advisory","_cs_vendors":["Wukong"],"content_html":"\u003cp\u003eWukong AICRM versions up to and including 20260610 are affected by a critical missing authorization vulnerability (CVE-2026-110207). The application fails to perform administrator-level permission checks on various administrative endpoints, including user, role, department, and agent management APIs. This flaw allows any authenticated user to interact with these sensitive functions. By sending a crafted POST request to the /managerUser/updateUser endpoint, an attacker can overwrite the administrator account's password and elevate their own privileges to the 'all' role. This vulnerability provides a straightforward path for unprivileged users to achieve full application administrative takeover. The vulnerability is highly exploitable, requiring only a valid standard user account to execute the administrative commands that lead to complete compromise of the AICRM instance.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates to the Wukong AICRM platform using a low-privileged user account.\u003c/li\u003e\n\u003cli\u003eAttacker performs discovery to identify administrative API endpoints such as /managerUser/updateUser.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious HTTP POST request targeting the /managerUser/updateUser administrative endpoint.\u003c/li\u003e\n\u003cli\u003eThe request includes parameters designed to reset the password of the administrative account.\u003c/li\u003e\n\u003cli\u003eThe server processes the request without validating if the sender possesses administrative authorization.\u003c/li\u003e\n\u003cli\u003eThe application updates the administrator password to a known value.\u003c/li\u003e\n\u003cli\u003eAttacker updates their account role to the 'all' role via the same or subsequent administrative API calls.\u003c/li\u003e\n\u003cli\u003eAttacker logs in as the administrator to gain full control over the CRM data and system configuration.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in total administrative account takeover of the Wukong AICRM platform. This allows attackers to exfiltrate customer relationship data, modify system configurations, and manage user roles. Given the nature of CRM systems, this data often contains sensitive PII, business strategy, and client communication logs. Any instance of Wukong AICRM running version 20260610 or earlier is at risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for security teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003ePatch or upgrade Wukong AICRM instances immediately to a version released after 20260610 that addresses CVE-2026-110207.\u003c/li\u003e\n\u003cli\u003eDeploy web server detection rules to monitor for unauthorized POST requests to /managerUser/updateUser from standard user sessions.\u003c/li\u003e\n\u003cli\u003eAudit logs for successful password changes or privilege escalations occurring through administrative API endpoints.\u003c/li\u003e\n\u003cli\u003eMonitor for suspicious activity originating from low-privileged accounts that attempt to access management-related URI paths.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T04:36:50Z","date_published":"2026-10-14T04:36:50Z","id":"https://feed.craftedsignal.io/briefs/2026-10-wukong-aicrm-auth-bypass/","summary":"Wukong AICRM versions through 20260610 contain a missing authorization vulnerability that allows authenticated users to call administrative APIs, leading to account takeover via password reset.","title":"Missing Authorization Vulnerability in Wukong AICRM","url":"https://feed.craftedsignal.io/briefs/2026-10-wukong-aicrm-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:wukong:aicrm:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}