CVE-2026-108689

MediumCVSS 5.4/10Last modified Oct 18, 2026

Description

Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows authenticated users to write into other users' AI chat sessions by supplying an arbitrary sessionId to POST /chat/send. Attackers can append messages to a victim's conversation and receive streamed assistant replies built from the victim's last 20 messages, disclosing conversation content.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Oct 11, 2026
Last modified: Oct 18, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1086904.3mall4j through 4.0 contains an information disclosure vulnerability that allows authenticated customers to read other shoppers' cart items d CVE-2026-1086915.4mall4j through 4.0 contains an improper authorization vulnerability that allows authenticated storefront customers to delete other shoppers'CVE-2026-1086926.51Panel-dev CordysCRM from 1.9.0 before 1.9.2 contains a missing authorization vulnerability in eight ModuleFieldController /field/source dat CVE-2026-1086937.0ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled search path vulnerability in NTGhostscriptEXE() that launches CVE-2026-1086946.5ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated users to read server files because src/conve CVE-2026-1086957.1MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketp CVE-2026-1086964.3CoreShop through 1.5.5 contains an authorization bypass vulnerability in the OrderController that allows authenticated customers to act on o CVE-2026-1086974.3CoreShop through 2026.2.2 contains a missing authorization vulnerability that allows low-privileged backend users to list permission-restric CVE-2026-1086986.5hyper-mcp through 0.8.3 contains a signature verification bypass vulnerability in load_wasm in src/wasm/oci.rs that verifies the Cosign sign CVE-2026-1086996.5hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load malicious WebAssembly plugin CVE-2026-10874.3The Guardian News Feed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is d CVE-2026-108707.2A flaw has been found in Shibby Tomato 1.28.0000. This affects the function start_dhcpc of the file /sbin/rc of the component Web UI. This m