Description
Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated user to read the stored AI provider API key. Attackers can request GET /systemConfig/byType/ai for the cleartext key, or send a chosen apiUrl to /systemConfig/ai/test, forwarding the stored key to their host.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
WuKongOpenSource Wukong AICRM
Default version status: unaffected
0 to ≤ 20260610affected
pkg:github/WuKongOpenSource/Wukong-AICRMReferences
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/wukong-aicrm-api-wide-missing-authorization ↗
- https://github.com/WuKongOpenSource/Wukong-AICRM/blob/20260610/backend/src/main/java/com/kakarote/ai_crm/service/impl/SystemConfigServiceImpl.java#L260-L294 ↗
- https://github.com/WuKongOpenSource/Wukong-AICRM/blob/20260610/backend/src/main/java/com/kakarote/ai_crm/service/impl/SystemConfigServiceImpl.java#L143-L155 ↗
- https://github.com/WuKongOpenSource/Wukong-AICRM/blob/20260610/backend/src/main/java/com/kakarote/ai_crm/service/impl/SystemConfigServiceImpl.java#L607-L619 ↗
- https://github.com/WuKongOpenSource/Wukong-AICRM/blob/20260610/backend/src/main/java/com/kakarote/ai_crm/controller/SystemConfigController.java#L53-L77 ↗
- https://github.com/WuKongOpenSource/Wukong-AICRM ↗
- https://www.vulncheck.com/advisories/wukong-aicrm-through-20260610-missing-authorization-in-system-configuration-apis-exposes-stored-ai-provider-keys ↗