Description
Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows authenticated users to write into other users' AI chat sessions by supplying an arbitrary sessionId to POST /chat/send. Attackers can append messages to a victim's conversation and receive streamed assistant replies built from the victim's last 20 messages, disclosing conversation content.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WuKongOpenSource | Wukong AICRM | ≤ 20260610 | — |
References
- Researcher Proof of Concept exploit
- Vulnerable Code (20260610) technical-description
- VulnCheck Advisory: Wukong AICRM through 20260610 Authorization Bypass via User-Controlled Session ID in POST /chat/send third-party-advisory