EUVD-2026-99249
GHSA-xv88-5j3j-77rr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as any low-privilege user
-
ExploitCall GET /systemConfig/byType/ai
-
ExecutionRead cleartext AI provider API key
-
ImpactAbuse or exfiltrate key via /systemConfig/ai/test
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated account on Wukong AICRM (any low-privilege user; PR:L) and that an AI provider API key has actually been stored in the system configuration - if no key is configured there is nothing to steal. Exploitation is otherwise unrestricted: the /systemConfig/byType/ai and /systemConfig/ai/test endpoints are reachable over the network with no user interaction and no admin role. The limiting factors defenders should weigh are the authentication requirement (not anonymous/unauthenticated) and the presence of a configured AI key; there is no UI, platform, or non-default-configuration dependency beyond having set up the AI integration. |
| Impact | The input provides a CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N, base 7.1), which is internally consistent with the description: network-reachable (AV:N), low complexity (AC:L), but requiring a valid low-privilege authenticated account (PR:L) with no user interaction. The high confidentiality impact (VC:H) is justified because the stored AI provider API key is returned in cleartext; integrity is correctly rated low (VI:L) since the /systemConfig/ai/test endpoint lets an attacker redirect the key to a host they control but does not broadly alter system state. Key signals are MISSING: no EPSS score was provided, there is no CISA KEV listing (so this is NOT confirmed actively exploited), and no SSVC decision data is included - so automatability and real-world exploitation volume cannot be quantified from the input. Public technical writeups with concrete request paths exist (VulnCheck advisory and a hackmd analysis), which lowers the barrier to exploitation, but no packaged exploit tool is referenced. Net assessment: a genuine, easily-triggered authorization flaw whose practical risk is tempered by two factors - it requires authentication (any logged-in user, PR:L) and the affected product is a niche open-source CRM. It is a real priority for organizations actually running Wukong AICRM with a configured AI key, but is unlikely to be mass-exploited given the limited deployment footprint. The 'Authentication Bypass' tag conflicts with CWE-862 (Missing Authorization) and the description's 'any authenticated user' wording - this is broken authorization, not authentication bypass. |
| Exploit ScenarioDerived | A low-privileged but authenticated user of Wukong AICRM (e.g., an ordinary employee account) issues GET /systemConfig/byType/ai and receives the stored AI provider API key in cleartext, or POSTs a chosen apiUrl to /systemConfig/ai/test causing the server to forward the stored key to an attacker-controlled host. The attacker then uses the stolen provider key to run up charges or access the organization's AI account. No public packaged exploit is identified, but step-by-step technical writeups (VulnCheck advisory, hackmd) describe the exact requests. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Authenticated users of Wukong AICRM (versions up to and including the 20260610 release) can retrieve the cleartext AI provider API key stored in the CRM's system configuration, because the /systemConfig controller enforces no authorization check on the relevant endpoints. Any low-privilege account can call GET /systemConfig/byType/ai to read the key directly, or post an attacker-controlled apiUrl to /systemConfig/ai/test to have the server forward the stored key to a host the attacker controls. Exploitation requires a valid account (PR:L per the CVSS 4.0 vector) and only works if an AI provider key has actually been configured; no public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV).
RemediationAI
No vendor-released patch or fixed version is identified in the available data - the repository reference points only at the vulnerable 20260610 revision, so treat any deployment at or below that build as exposed until the maintainers publish an authorization fix. The highest-value immediate action is to rotate every AI provider API key that has been stored in Wukong AICRM system configuration, since the key must be assumed compromised once any non-admin user could read it or cause it to be forwarded; rotating revokes the attacker's usable credential even if the code is not yet patched, at the cost of reconfiguring the AI integration. Second, restrict access to the /systemConfig endpoints: at a reverse proxy or WAF, permit /systemConfig/* only from administrative source networks or require admin-level session claims, and return 403 for the /systemConfig/byType/ai and /systemConfig/ai/test paths from ordinary users - the trade-off is that legitimate low-privilege configuration UI functions relying on those paths will break, so scope the rule to these two routes. Third, because /systemConfig/ai/test accepts an arbitrary apiUrl, block server-initiated outbound requests from the application host to untrusted destinations (egress allowlisting) so the stored key cannot be relayed to an attacker-controlled endpoint; this also reduces SSRF blast radius but may interfere with legitimate third-party AI providers unless they are explicitly allowlisted. Finally, monitor configurations for unexpected apiUrl values and audit outbound traffic from the CRM host for the provider's key material, and consult https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/wukong-aicrm-api-wide-missing-authorization and the VulnCheck advisory for further detail.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic missing authorization (CWE-862) issue in the Spring Boot backend of Wukong AICRM. The referenced source files - SystemConfigController.java (lines 53-77) and the corresponding SystemConfigServiceImpl.java sections (lines 143-155, 260-294, 607-619) - implement system-configuration retrieval and an AI connectivity test without verifying that the caller holds an administrative role. The controller exposes configuration grouped by type, and the 'ai' type resolves to the stored provider credentials, returning them in cleartext to any authenticated session. The 'ai/test' path additionally accepts a caller-supplied apiUrl and uses it as the destination for an outbound request that carries the stored API key, which combines the authorization gap with a server-side request forgery style exfiltration primitive: the attacker does not need to read the key response at all, they simply point the test at their own server to receive it. The CPE/advisory data identifies the affected tree as Wukong AICRM 0 through 20260610, and the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N) matches this reading - network reachable, low complexity, low privileges required, high confidentiality impact, limited integrity impact from the attacker-supplied apiUrl, and no availability or scope impact. The independent assessment concurs with this vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) and adds the precondition that a key must actually be configured for the confidentiality impact to materialize.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Network-reachable endpoints need only a low-privilege authenticated session (PR:L, AC:L); cleartext key disclosure gives C:H, the chosen-apiUrl forwarding gives I:L, no availability impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
DescriptionCVE.org
Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated user to read the stored AI provider API key. Attackers can request GET /systemConfig/byType/ai for the cleartext key, or send a chosen apiUrl to /systemConfig/ai/test, forwarding the stored key to their host.
Executive ViewAI
Wukong AICRM versions up to and including the 20260610 release contain an authorization flaw that allows any authenticated low-privilege user to retrieve the cleartext AI provider API key from the system configuration. This exposure could enable unauthorized use of AI services, potential data leakage, and unexpected costs. Leadership should prioritize mitigation because the vulnerability requires only a valid account and affects all deployments where an AI provider key is configured.
Restrict access to /systemConfig endpoints to authorized administrative accounts; implement network segmentation or WAF rules to block unauthorized requests to /systemConfig/byType/ai and /systemConfig/ai/test; rotate AI provider API keys; monitor for anomalous outbound connections from the CRM server; disable AI provider integration if not needed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB