Wukong AICRM up to the 20260610 release contains a missing authorization flaw that allows any authenticated user to invoke user and role management APIs that should be restricted to administrators. By sending a POST request to the /managerUser/updateUser endpoint, an attacker can reset the administrator account’s password and assign themselves a role that grants all privileges, effectively taking over the system’s administrative control. This is a high‑severity privilege escalation that compromises the confidentiality, integrity, and availability of the entire application.

The vulnerable product is WuKongOpenSource’s Wukong AICRM, specifically the 20260610 release and prior versions that have not been patched. Users operating in this version are at risk if they authenticate and then invoke the exposed endpoints.

The vulnerability carries a CVSS score of 8.7, indicating significant risk. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be an authenticated API-based attack; any logged‑in user can invoke the vulnerable endpoints without role checks. Once exploited, the attacker gains full administrative rights, making this a critical threat if not remediated immediately.