EUVD-2026-96712
GHSA-2p74-f492-56xr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
DeliverySupply victim's sessionId to POST /chat/send
-
ExploitBackend appends message without ownership check
-
ExecutionReceive streamed reply built from victim's last 20 messages
-
ImpactDisclose victim conversation content
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Requires a valid authenticated account on the target Wukong AICRM instance (PR:L) - exploitation is not available to fully anonymous attackers. Given any such account, no further special conditions, non-default configuration, or user interaction are needed: the attacker simply issues POST /chat/send with an arbitrary victim sessionId against a default deployment. The chief limiting factors are the authentication requirement and the fact that impact is confined to AI chat session content (reading another user's recent messages and injecting messages), not broader system or account takeover. |
| Impact | This is a moderate, authorization-focused information-disclosure/tampering issue rather than a top-tier emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N) yields a 5.3 (Medium): network-reachable and low-complexity, but it explicitly requires low-privileged authentication (PR:L), which materially caps blast radius to users who already hold a valid account on the instance. Public exploit code exists (VulnCheck-referenced GitHub POC), which raises practical exploitability, but the vulnerability is NOT in CISA KEV and no EPSS score was supplied, so there is no evidence of active, widespread exploitation - POC availability and active exploitation are distinct signals and should not be conflated. No SSVC decision data was provided. The confidentiality and integrity impacts are rated Low because exposure is limited to AI chat conversation content (a victim's last ~20 messages) and the ability to inject messages into another user's session, not full system compromise. Net: treat as a real but non-critical priority - patch in normal cadence, prioritized upward only where sensitive data flows through the AI chat feature. No signals conflict materially; the main limiter (authentication requirement) is consistent across the CVSS vector and description. |
| Exploit ScenarioDerived | A low-privileged but authenticated user of a Wukong AICRM instance sends a POST /chat/send request substituting another user's sessionId for their own. Because the backend does not verify session ownership (CWE-639), the attacker's message is appended to the victim's conversation and the assistant streams back a reply synthesized from the victim's last 20 messages, leaking that conversation's content. A public POC (poc_chat_send.py) demonstrates the request, lowering the skill barrier. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
Wukong AICRM (all versions through the 20260610 release) fails to verify ownership of the AI chat session identifier passed to POST /chat/send, so any user holding a valid account on the instance can read and append to another user's conversation. Because the endpoint streams back an assistant reply generated from the victim's most recent 20 messages, the attacker receives verbatim conversation content rather than just a write primitive. Exploitation requires authentication (PR:L) but no user interaction or non-default configuration, and publicly available exploit code exists (poc_chat_send.py), so the practical barrier is simply obtaining any low-privileged account. Rated CVSS 4.0 5.3 / CVSS 3.1 5.3, this is a moderate authorization-focused disclosure-and-tampering issue confined to chat session data, not account or system takeover.
RemediationAI
No vendor-released patch was identified at time of analysis, so remediation must start with compensating controls. First, add a server-side ownership check in ChatServiceImpl so that POST /chat/send resolves the session by (sessionId AND authenticated userId) and rejects mismatches with 403; this is the definitive fix and has no functional side effects beyond a potential need to re-map any legacy sessions whose owner metadata is missing. Second, as an interim control, restrict or disable multi-user chat functionality if the business can tolerate it, or place POST /chat/send behind an authenticated reverse-proxy rule that only permits access from trusted networks/VPN - the trade-off is reduced external usability for legitimate chat clients. Third, harden session IDs (high-entropy UUIDv4 rather than sequential or guessable values) and add rate limiting plus anomaly detection on cross-user session access, since enumeration becomes impractical and noisy; note this reduces but does not eliminate the flaw because the authorization check is still absent. Fourth, deploy a WAF or API gateway rule that flags requests where the sessionId does not correlate with the caller, understanding that such rules are heuristic and can produce false positives. Finally, monitor backend logs for repeated 403s or unusual session-to-user pairings and rotate any exposed session identifiers. Track the VulnCheck advisory at https://www.vulncheck.com/advisories/wukong-aicrm-through-20260610-authorization-bypass-via-user-controlled-session-id-in-post-chat-send for an official fix, and note that publicly available exploit code (poc_chat_send.py) lowers the effort required for attackers who already hold any account.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a classic authorization bypass through a user-controlled key (CWE-639): the POST /chat/send handler accepts a client-supplied sessionId and uses it to look up the conversation without validating that the authenticated principal owns that session. The vulnerable logic lives in the Wukong AICRM Spring/Java backend at backend/src/main/java/com/kakarote/ai_crm/service/impl/ChatServiceImpl.java (around lines 270-283), which the CVE organization cites directly from the upstream repository. Because the same code path both persists the incoming message and assembles the LLM context window from stored history, an attacker who guesses or enumerates another user's session identifier gets a double impact in a single request: unauthorized write (message injection into the victim's thread) and unauthorized read (the streamed assistant response is conditioned on the victim's prior 20 messages). The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N confirms the attack is network-reachable with low privileges, no attack requirements, and no user interaction, with limited confidentiality and integrity impact on the vulnerable system and no subsequent-system impact. The CPE cpe:2.3:a:wukongopensource:wukong_aicrm:*:*:*:*:*:*:*:* indicates the affected product line is version-agnostic in the CPE dictionary, matching the advisory's 'through 20260610' statement. Note that session IDs in this design appear to be the only access-control primitive, so their predictability and the absence of per-request ownership checks are the central weaknesses.
Know when Wukong Aicrm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Network endpoint with low complexity but a valid login is required so PR:L; cross-user chat read gives C:L and message injection gives I:L, with no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows authenticated users to write into other users' AI chat sessions by supplying an arbitrary sessionId to POST /chat/send. Attackers can append messages to a victim's conversation and receive streamed assistant replies built from the victim's last 20 messages, disclosing conversation content.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB