CVE-2026-108689 — Wukong AICRM through 20260610 Authorization Bypass via User-Controlled Session ID in POST /chat/send
Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows authenticated users to write into other users' AI chat sessions by supplying an arbitrar…
Published: 2026-10-11 · CVSS: 5.3 · CVSS 4.0
Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows authenticated users to write into other users' AI chat sessions by supplying an arbitrary sessionId to POST /chat/send. Attackers can append messages to a victim's conversation and receive streamed assistant replies built from the victim's last 20 messages, disclosing conversation content.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7