Wukong Aicrm
Monthly
Wukong AICRM (all versions through the 20260610 release) fails to verify ownership of the AI chat session identifier passed to POST /chat/send, so any user holding a valid account on the instance can read and append to another user's conversation. Because the endpoint streams back an assistant reply generated from the victim's most recent 20 messages, the attacker receives verbatim conversation content rather than just a write primitive. Exploitation requires authentication (PR:L) but no user interaction or non-default configuration, and publicly available exploit code exists (poc_chat_send.py), so the practical barrier is simply obtaining any low-privileged account. Rated CVSS 4.0 5.3 / CVSS 3.1 5.3, this is a moderate authorization-focused disclosure-and-tampering issue confined to chat session data, not account or system takeover.
Wukong AICRM (all versions through the 20260610 release) fails to verify ownership of the AI chat session identifier passed to POST /chat/send, so any user holding a valid account on the instance can read and append to another user's conversation. Because the endpoint streams back an assistant reply generated from the victim's most recent 20 messages, the attacker receives verbatim conversation content rather than just a write primitive. Exploitation requires authentication (PR:L) but no user interaction or non-default configuration, and publicly available exploit code exists (poc_chat_send.py), so the practical barrier is simply obtaining any low-privileged account. Rated CVSS 4.0 5.3 / CVSS 3.1 5.3, this is a moderate authorization-focused disclosure-and-tampering issue confined to chat session data, not account or system takeover.