CVE-2026-110208— Wukong AICRM through 20260610 Missing Authorization in System Configuration APIs Exposes Stored AI Provider Keys
Quick assessment
Affected
WuKongOpenSource Wukong AICRM
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
悟空AICRM（版本至20260610）在/systemConfig控制器中存在一个缺失授权验证的安全漏洞，该漏洞允许任何经过身份认证的用户读取已存储的AI提供商API密钥。攻击者可以通过发送GET请求至/systemConfig/byType/ai来获取明文格式的API密钥，或者向/systemConfig/ai/test端点提交自定义的apiUrl参数，从而将已存储的API密钥转发至攻击者控制的服务器。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| WuKongOpenSource | Wukong AICRM | ≤ 20260610 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-110208
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Wukong AICRM through 20260610 Missing Authorization in System Configuration APIs Exposes Stored AI Provider Keys
Source: CVE Program / CVE List V5
Vulnerability Description
Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated user to read the stored AI provider API key. Attackers can request GET /systemConfig/byType/ai for the cleartext key, or send a chosen apiUrl to /systemConfig/ai/test, forwarding the stored key to their host.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| WuKongOpenSource | Wukong AICRM | 0 ~ 20260610 | - |
|
II. Public POCs for CVE-2026-110208
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-110208
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-110208 (1)
Vendor Advisories for CVE-2026-110208 (1)
Other References for CVE-2026-110208 (1)
IV. Related Vulnerabilities
Same vendor: WuKongOpenSource
-
CVE-2026-110207
Wukong AICRM through 20260610 Missing Authorization in User -
CVE-2026-108707
Wukong_HRM through commit 186115e Authentication Bypass via -
CVE-2026-108708
Wukong_HRM through commit 186115e Missing Authorization via -
CVE-2026-108689
Wukong AICRM through 20260610 Authorization Bypass via User- -
CVE-2026-2141
WuKongOpenSource WukongCRM URL PermissionServiceImpl.java im
Same weakness: CWE-862
-
CVE-2026-19798
WP Map Block <= 3.0.0 - Missing Authorization to Authenticat -
CVE-2026-107770
Photo Engine (Media Organizer & Lightroom) <= 6.5.6 - Missin -
CVE-2026-107659
Modula Image Gallery <= 3.0.11 - Missing Authorization to Un -
CVE-2026-110019
Bulk Page Generator <= 3.1.0 - Missing Authorization to Auth -
CVE-2026-110590
Klarna for WooCommerce <= 4.13.3 - Missing Authorization to
V. Comments for CVE-2026-110208
No comments yet