Wukongopensource Wukong Aicrm vulnerabilities

3 CVEs affecting Wukongopensource Wukong Aicrm, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-110208, published 2026-10-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-110207, published 2026-10-13. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows any authenticated user to call user, role, department and agent administration APIs because no administrator…
CVE-2026-110208, published 2026-10-13. High severity, CVSS 7.1. EPSS: 0.4% chance of exploitation in the next 30 days. Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated user to read the stored AI provider API key. Attackers can…
CVE-2026-108689, published 2026-10-11. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows authenticated users to write into other users' AI chat sessions by supplying an arbitrary sessionId to POST…