A flaw in WuKongOpenSource WukongCRM’s URL Handler, specifically PermissionServiceImpl.java, allows an attacker to manipulate requests and bypass normal authorization checks. The vulnerability can be triggered remotely, giving the attacker the ability to access protected URLs that should be restricted. Consequently, sensitive data could be disclosed or further compromised, depending on the privileges granted by the accessed endpoints. The CVSS score of 5.3 reflects a moderate severity because the compromised data or services may be of importance to the affected organization.

The issue exists in all instances of WuKongOpenSource WukongCRM up to and including release 11.3.3. Applications that include the gateway component and use the PermissionServiceImpl module are affected. No other vendors or product versions are listed; therefore, all deployments of the specified version range should be reviewed.

With an estimated EPSS of less than one percent and no listing in the KEV catalog, the likelihood of widespread exploitation remains low at present. However, the fact that a public exploit has been released indicates that attackers could soon target vulnerable installations. The attack is likely performed over the web, requiring remote manipulation of URL requests without needing authenticated access. Organizations should consider this a moderate risk until a patch is applied or a mitigative configuration change is made.