CVE-2026-110207

Summary

A missing authorization check in Wukong AICRM allows any authenticated user to perform administrative functions like resetting admin passwords and assigning admin roles, leading to full system takeover. This vulnerability exists because the application fails to verify if a user has administrative privileges before allowing access to sensitive management APIs.

Exploitability

The exploit is relatively straightforward requiring only an authenticated session and the ability to send POST requests to specific endpoints, with no additional prerequisites for exploitation.

Blast radius

An attacker could gain complete administrative control over the system, potentially compromising all user data, roles, departments, and agents, with minimal effort once they have an authenticated account.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable access to the /managerUser/updateUser endpoint until a patch is applied, or restrict this endpoint to only be accessible from internal network sources.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.