EUVD-2026-99248
GHSA-qhwv-w4m8-x75g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as any low-privileged user
-
ExploitSend POST to /managerUser/updateUser (no admin check)
-
ExecutionReset admin password and assign self the 'all' role
-
ImpactFull administrator account takeover of the CRM
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must hold any valid authenticated account on the Wukong AICRM instance (PR:L) - no administrator role is required because the user, role, department and agent administration APIs perform no administrator check in SecurityConfig. Given a credentialed account, exploitation works against default configurations with no user interaction, no special feature toggle, and no non-default deployment mode: the attacker simply issues a POST to /managerUser/updateUser (or the other unprotected management endpoints). The only meaningful limiting factor is the requirement for a pre-existing authenticated (even minimally privileged) account on the application; unauthenticated external attackers cannot directly invoke these endpoints. |
| Impact | The CVSS 4.0 base score of 8.7 (High) reflects a network-reachable (AV:N), low-complexity (AC:L) flaw needing only a low-privileged authenticated account (PR:L) and no user interaction (UI:N), with high confidentiality, integrity and availability impact to the vulnerable system (VC:H/VI:H/VA:H) and no subsequent-system scope change (SC:N/SI:N/SA:N). The vulnerability class (CWE-862 Missing Authorization) is well corroborated: the VulnCheck advisory and hackmd writeup cite the exact unprotected endpoints and the specific SecurityConfig/controller/service source lines, so the technical claim is strong. However, several real-risk signals are MISSING: no EPSS exploitation-probability score is provided, the CVE is NOT listed in CISA KEV, and no explicit POC/exploit-code flag is present (though the hackmd and VulnCheck writeups document the exact malicious request, which materially lowers the effort to weaponize). No SSVC decision data was supplied. Net assessment: this is a genuine, easily-exploitable privilege-escalation-to-admin bug for any environment running Wukong AICRM, but its real-world priority is tempered by (a) the need for a pre-existing authenticated account and (b) the product's apparently niche, open-source deployment footprint, suggesting targeted rather than mass exploitation. Note the input Tag 'Authentication Bypass' conflicts with CWE-862 and the description, which describe authorization failure for an already-authenticated user, not authentication bypass. |
| Exploit ScenarioDerived | A low-privileged authenticated user of the CRM (for example a sales agent) sends a crafted POST request to /managerUser/updateUser, which lacks any administrator authorization check, to reset the built-in admin account's password and grant their own account the 'all' role. No public exploit code is flagged, but the VulnCheck advisory and the hackmd writeup document the exact endpoint and request, and the network vector with low attack complexity (AV:N/AC:L) makes the request trivial to reproduce once an account exists. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Missing authorization in Wukong AICRM through 20260610 allows any authenticated user, without administrator privileges, to invoke user, role, department, and agent administration APIs and take over the administrator account. By sending a POST to /managerUser/updateUser, an attacker with any valid low-privileged account can reset the admin password and assign themselves the 'all' role, achieving full administrative control. The flaw is rated CVSS 8.7 (High) with network reachability, low attack complexity, and no user interaction; no CISA KEV entry was present and no public exploit identified at time of analysis.
RemediationAI
No vendor-released patch identified at time of analysis; apply the following compensating controls until an official fix is available. Implement an authorization check at the application or reverse-proxy layer that requires an administrator role for /managerUser/*, /managerRole/*, /managerDepartment/*, and /managerAgent/* endpoints, especially POST /managerUser/updateUser; this will break legitimate administrative management functions unless the rule is scoped to trusted administrative users or IPs. As a temporary virtual patch, block POST requests to /managerUser/updateUser from all non-administrative accounts or from all users except trusted admin source IPs at the WAF/reverse proxy, accepting that legitimate admin password-reset workflows will be blocked until the block is lifted. Audit the AICRM instance for unauthorized password changes, role assignments (especially the 'all' role), and suspicious POST requests to management endpoints, and rotate administrator credentials and any potentially compromised accounts. Restrict account creation and enforce least privilege on all AICRM accounts to reduce the population of authenticated users who can reach the vulnerable APIs, and monitor the VulnCheck advisory and upstream repository for a patched release. References: https://www.vulncheck.com/advisories/wukong-aicrm-through-20260610-missing-authorization-in-user-and-role-management-apis and https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/wukong-aicrm-api-wide-missing-authorization.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is CWE-862 (Missing Authorization) in the Java/Spring backend of Wukong AICRM. The referenced SecurityConfig.java lines 66-84 define URL authorization rules but fail to require an administrator authority for management endpoints, while ManagerUserController.java lines 45-72 exposes POST /managerUser/updateUser and service implementations in ManageUserServiceImpl.java lines 181-237 and ManagerRoleServiceImpl.java lines 224-243 perform password-reset and role-assignment operations without checking the caller's privileges. EUVD lists Wukong AICRM 0 through 20260610 as affected; no CPE string was included in the input. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) confirms a network-reachable, low-complexity privilege-escalation path that requires only a pre-existing authenticated account (PR:L), with high confidentiality, integrity, and availability impact to the vulnerable system and no subsequent-system scope change. The referenced code and advisory links (VulnCheck and a HackMD writeup) document the missing check across user, role, department, and agent administration APIs.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network-reachable admin API callable by any authenticated low-privileged user (PR:L) with no user interaction; privilege escalation stays within the same application (S:U) and yields full admin control (C/I/A:H).
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
DescriptionCVE.org
Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows any authenticated user to call user, role, department and agent administration APIs because no administrator check exists. Attackers can send POST requests to /managerUser/updateUser to reset the admin account's password and assign themselves the "all" role, achieving full administrator account takeover.
Executive ViewAI
Wukong AICRM deployments through version 20260610 contain an authorization flaw that allows the holder of any valid low-privileged account to reset administrator credentials and grant themselves full administrative rights over the CRM. Because these systems typically hold customer, sales pipeline, and agent records, a single compromised user account could yield complete control of the platform and its data. With no vendor patch currently available, leadership should treat this as a high-priority exposure that depends on network restrictions, access hygiene, and monitoring until a fix is released.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to the administrative APIs (/managerUser/updateUser and related user, role, department, and agent endpoints) to trusted management networks via WAF, reverse proxy, or firewall rules; remove internet exposure of the CRM administration interface; minimize and deprovision low-privileged accounts, since any valid account is sufficient to reach the flaw; enforce MFA on all accounts and rotate administrator credentials; alert on role changes, password resets, and anomalous POSTs to /managerUser/updateUser; and maintain enhanced logging and manual review of administrative activity until a fix is available. No public exploit identified at time of analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB