CVE-2026-2141— WuKongOpenSource WukongCRM URL PermissionServiceImpl.java improper authorization
Quick assessment
Affected
WuKongOpenSource WukongCRM
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WukongCRM是中国悟空（Wukong）公司的一个客户关系管理 (CRM) 系统。 WukongCRM 11.3.3及之前版本存在授权问题漏洞，该漏洞源于对组件URL Handler中文件gateway/src/main/java/com/kakarote/gateway/service/impl/PermissionServiceImpl.java的错误操作，可能导致授权不当。
Possible ATT&CK Techniques 1 AI
T1068 · Exploitation for Privilege Escalation
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-2141
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WuKongOpenSource WukongCRM URL PermissionServiceImpl.java improper authorization
Source: CVE Program / CVE List V5
Vulnerability Description
A security flaw has been discovered in WuKongOpenSource WukongCRM up to 11.3.3. This affects an unknown part of the file gateway/src/main/java/com/kakarote/gateway/service/impl/PermissionServiceImpl.java of the component URL Handler. Performing a manipulation results in improper authorization. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
WukongCRM 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WukongCRM是中国悟空（Wukong）公司的一个客户关系管理 (CRM) 系统。 WukongCRM 11.3.3及之前版本存在授权问题漏洞，该漏洞源于对组件URL Handler中文件gateway/src/main/java/com/kakarote/gateway/service/impl/PermissionServiceImpl.java的错误操作，可能导致授权不当。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| WuKongOpenSource | WukongCRM | 11.3.0 | - |
|
II. Public POCs for CVE-2026-2141
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-2141
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-2141 (1)
IV. Related Vulnerabilities
Same product: WukongCRM
Same vendor: WuKongOpenSource
-
CVE-2026-110208
Wukong AICRM through 20260610 Missing Authorization in Syste -
CVE-2026-110207
Wukong AICRM through 20260610 Missing Authorization in User -
CVE-2026-108708
Wukong_HRM through commit 186115e Missing Authorization via -
CVE-2026-108707
Wukong_HRM through commit 186115e Authentication Bypass via -
CVE-2026-108689
Wukong AICRM through 20260610 Authorization Bypass via User-
Same weakness: CWE-285
-
CVE-2026-109605
SourceCodester Simple Cafe Billing System User Management ad -
CVE-2026-109962
Froxlor 0.10.0 before 2.3.14 Missing Authorization in MysqlS -
CVE-2026-17475
IBM Planning Analytics Local is affected by security vulnera -
CVE-2023-54410
Frappe before 13.22.0 Improper Authorization via Document Re -
CVE-2026-84314
Nginx UI: Account Takeover via Missing `RequireSecureSession
V. Comments for CVE-2026-2141
No comments yet