Description
Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated user to read the stored AI provider API key. Attackers can request GET /systemConfig/byType/ai for the cleartext key, or send a chosen apiUrl to /systemConfig/ai/test, forwarding the stored key to their host.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WuKongOpenSource | Wukong AICRM | ≤ 20260610 | — |
References
- Researcher Advisory third-party-advisory
- Vulnerable Code: SystemConfigServiceImpl AI test (20260610) technical-description
- Vulnerable Code: SystemConfigServiceImpl.getConfigsByType (20260610) technical-description
- Vulnerable Code: SystemConfigServiceImpl.resolveSecret (20260610) technical-description
- SystemConfigController (20260610) technical-description
- https://github.com/WuKongOpenSource/Wukong-AICRM product
- VulnCheck Advisory: Wukong AICRM through 20260610 Missing Authorization in System Configuration APIs Exposes Stored AI Provider Keys third-party-advisory