High severity7.1NVD Advisory· Published Oct 13, 2026· Updated Oct 13, 2026
CVE-2026-110208
CVE-2026-110208
Description
Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated user to read the stored AI provider API key. Attackers can request GET /systemConfig/byType/ai for the cleartext key, or send a chosen apiUrl to /systemConfig/ai/test, forwarding the stored key to their host.
Affected products
1- Range: <=20260610
Patches
Vulnerability mechanics
References
6- github.com/WuKongOpenSource/Wukong-AICRM/blob/20260610/backend/src/main/java/com/kakarote/ai_crm/controller/SystemConfigController.javanvd
- github.com/WuKongOpenSource/Wukong-AICRM/blob/20260610/backend/src/main/java/com/kakarote/ai_crm/service/impl/SystemConfigServiceImpl.javanvd
- github.com/WuKongOpenSource/Wukong-AICRM/blob/20260610/backend/src/main/java/com/kakarote/ai_crm/service/impl/SystemConfigServiceImpl.javanvd
- github.com/WuKongOpenSource/Wukong-AICRM/blob/20260610/backend/src/main/java/com/kakarote/ai_crm/service/impl/SystemConfigServiceImpl.javanvd
- hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/wukong-aicrm-api-wide-missing-authorizationnvd
- www.vulncheck.com/advisories/wukong-aicrm-through-20260610-missing-authorization-in-system-configuration-apis-exposes-stored-ai-provider-keysnvd
News mentions
0No linked articles in our index yet.