Description
Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows any authenticated user to call user, role, department and agent administration APIs because no administrator check exists. Attackers can send POST requests to /managerUser/updateUser to reset the admin account's password and assign themselves the "all" role, achieving full administrator account takeover.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
WuKongOpenSource Wukong AICRM
Default version status: unaffected
0 to ≤ 20260610affected
pkg:github/WuKongOpenSource/Wukong-AICRMReferences
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/wukong-aicrm-api-wide-missing-authorization ↗
- https://github.com/WuKongOpenSource/Wukong-AICRM/blob/20260610/backend/src/main/java/com/kakarote/ai_crm/service/impl/ManageUserServiceImpl.java#L181-L237 ↗
- https://github.com/WuKongOpenSource/Wukong-AICRM/blob/20260610/backend/src/main/java/com/kakarote/ai_crm/config/SecurityConfig.java#L66-L84 ↗
- https://github.com/WuKongOpenSource/Wukong-AICRM/blob/20260610/backend/src/main/java/com/kakarote/ai_crm/controller/ManagerUserController.java#L45-L72 ↗
- https://github.com/WuKongOpenSource/Wukong-AICRM/blob/20260610/backend/src/main/java/com/kakarote/ai_crm/service/impl/ManagerRoleServiceImpl.java#L224-L243 ↗
- https://github.com/WuKongOpenSource/Wukong-AICRM ↗
- https://www.vulncheck.com/advisories/wukong-aicrm-through-20260610-missing-authorization-in-user-and-role-management-apis ↗