Wukong AICRM versions up to 20260610 contain a missing‑authorization flaw in the /systemConfig controller, allowing any authenticated user to retrieve the stored AI provider API key. The flaw enables the cleartext key to be read via GET /systemConfig/byType/ai and can also be forwarded to an attacker‑controlled host using /systemConfig/ai/test. The vulnerability is a classic instance of missing authorization (CWE‑862), exposing sensitive credential data that could be misused to impersonate the AI provider or abuse the API. The primary impact is potential confidentiality compromise of critical integration secrets, with secondary risks of broader API abuse.

The affected product is WuKongOpenSource:Wukong AICRM. All releases up to and including version 20260610 are vulnerable. No specific version list is provided beyond the release date indicator.

The CVSS score of 7.1 classifies the issue as high severity, and the vulnerability has not been listed in CISA's KEV catalog. EPSS is not available, so the current exploitation likelihood cannot be quantified, but the flaw is exploitable by any user who can authenticate with the system. Because the attack requires no special privileges beyond basic authentication, the threat level remains significant for exposed installations.