What is GHSA-2p74-f492-56xr?

GHSA-2p74-f492-56xr is a security advisory published by GitHub Security Advisories with Medium severity. Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows...

Which CVE IDs does GHSA-2p74-f492-56xr cover?

GHSA-2p74-f492-56xr covers the following CVE IDs: CVE-2026-108689. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-2p74-f492-56xr?

GHSA-2p74-f492-56xr has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

GHSA-2p74-f492-56xrMediumCVSS 5.4

Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows...

Vendor

GitHub Security Advisories

Published

October 11, 2026

Last Modified

October 11, 2026

🔗 CVE IDs covered (1)

CVE-2026-108689 →

📋 Description

Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows authenticated users to write into other users' AI chat sessions by supplying an arbitrary sessionId to POST /chat/send. Attackers can append messages to a victim's conversation and receive streamed assistant replies built from the victim's last 20 messages, disclosing conversation content.

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2026-108689
https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/Wukong-AICRM/poc_chat_send.py
https://github.com/WuKongOpenSource/Wukong-AICRM/blob/cdd1fbc3187d2bcbf2cdf2be7d50c988959da356/backend/src/main/java/com/kakarote/ai_crm/service/impl/ChatServiceImpl.java#L270-L283
https://www.vulncheck.com/advisories/wukong-aicrm-through-20260610-authorization-bypass-via-user-controlled-session-id-in-post-chat-send
https://github.com/advisories/GHSA-2p74-f492-56xr