CVE-2026-2141: medium-severity vulnerability in WuKongOpenSource WukongCRM
WuKongOpenSource WukongCRM URL PermissionServiceImpl.java improper authorization
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.4%
A security flaw has been discovered in WuKongOpenSource WukongCRM up to 11.3.3. This affects an unknown part of the file gateway/src/main/java/com/kakarote/gateway/service/impl/PermissionServiceImpl.java of the component URL Handler. Performing a manipulation results in improper authorization. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
WuKongOpenSource · WukongCRMRelated CVEs — WuKongOpenSource WukongCRM
In the same product, most dangerous first.
CVE-2025-8852MEDIUMWuKongOpenSource WukongCRM API Response upload information exposureEPSS 0.4%CVE-2025-5879MEDIUMWuKongOpenSource WukongCRM File Upload AdminSysConfigController.java cross site scriptingEPSS 0.3%CVE-2025-5521MEDIUMWuKongOpenSource WukongCRM updataPassword cross-site request forgeryEPSS 0.3%CVE-2025-6106MEDIUMWuKongOpenSource WukongCRM AdminRoleController.java cross-site request forgeryEPSS 0.3%