CVE-2026-108689Published
Wukong AICRM through 20260610 Authorization Bypass via User-Controlled Session ID in POST /chat/send
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-108689 · Microsoft / collected KEV context
cve-program · CVE-2026-108689
- https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/Wukong-AICRM/poc_chat_send.py
- https://github.com/WuKongOpenSource/Wukong-AICRM/blob/cdd1fbc3187d2bcbf2cdf2be7d50c988959da356/backend/src/main/java/com/kakarote/ai_crm/service/impl/ChatServiceImpl.java#L270-L283
- https://www.vulncheck.com/advisories/wukong-aicrm-through-20260610-authorization-bypass-via-user-controlled-session-id-in-post-chat-send
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.