{"data":{"id":"d000587a-b9de-4be7-9f97-e103e2d20bdd","title":"CVE-2026-110207: Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows any authenticated user to call…","summary":"Wukong AICRM through 20260610 has a missing authorization flaw that lets any authenticated user call user, role, department and agent administration APIs, since no administrator check exists. An attacker can send POST requests to /managerUser/updateUser to reset the admin account's password and assign themselves the \"all\" role, achieving full administrator account takeover.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110207","publishedAt":"2026-10-13T19:18:44.337Z","cveId":"CVE-2026-110207","cweIds":["CWE-862"],"cvssScore":"8.8","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Wukong AICRM"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Wukong AICRM missing authorization in user and role administration APIs","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0,"epssCheckedAt":"2026-10-14T06:09:04.733Z","kevDateAdded":null,"advisoryAliases":["GHSA-qhwv-w4m8-x75g"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-14T06:09:09.018Z","patchAvailable":null,"disclosureDate":"2026-10-13T19:18:44.337Z","capecIds":["CAPEC-122"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.6,"researchCategory":null,"atlasIds":null}}