PT-2026-6968 · Wukongopensource · Wukongcrm

Sourbyte · Published 2026-01-21 · Updated 2026-05-06 · CVE-2026-2141

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WuKongOpenSource WukongCRM versions through 11.3.3

Description A security flaw exists in WuKongOpenSource WukongCRM, specifically within the URL Handler component. The issue resides in the file gateway/src/main/java/com/kakarote/gateway/service/impl/PermissionServiceImpl.java and results in improper authorization. Remote exploitation is possible through manipulation. The exploit has been publicly released and may be used in attacks. The vendor was notified but did not respond.

Recommendations Versions prior to 11.3.3 should be updated.

Exploit

Fix

Improper Authorization

Incorrect Privilege Assignment

Incorrect Authorization

Weakness Enumeration

CWE-285

CWE-266

CWE-863

Related Identifiers

CVE-2026-2141

OPENSUSE-SU-2026:10078-1

Affected Products

Wukongcrm

References · 13

• 🔥 https://github.com/SourByte05/SourByte-Lab/issues/8 · Exploit
• https://osv.dev/vulnerability/CVE-2026-2141 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10078-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-2141 · Security Note
• https://t.me/cveNotify/154410 · Telegram Post
• https://suse.com/security/cve/CVE-2026-23490 · Note
• https://vuldb.com/?submit.747264 · Note
• https://t.me/cveNotify/151288 · Telegram Post
• https://vuldb.com/?id.344776 · Note
• https://twitter.com/Cyberwarzonecom/status/2051978876411113556 · Twitter Post
• https://suse.com/security/cve/CVE-2026-2141 · Note
• https://t.me/CVEtracker/44091 · Telegram Post
• https://vuldb.com/?ctiid.344776 · Note