CVE-2026-110207: Wukongopensource Wukong Aicrm

High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days.

Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows any authenticated user to call user, role, department and agent administration APIs because no administrator check exists. Attackers can send POST requests to /managerUser/updateUser to reset the admin account's password and assign themselves the "all" role, achieving full administrator account takeover.

Affected products

• Wukongopensource Wukong Aicrm: up to and including 20260610

Published 2026-10-13. Last modified 2026-10-14.