CVE-2026-2141

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-2141
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-2141.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-2141
Downstream
Related
Published
2026-02-08T07:32:06.928Z
Modified
2026-07-16T03:48:20.565227239Z
Severity
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
WuKongOpenSource WukongCRM URL PermissionServiceImpl.java improper authorization
Details

A security flaw has been discovered in WuKongOpenSource WukongCRM up to 11.3.3. This affects an unknown part of the file gateway/src/main/java/com/kakarote/gateway/service/impl/PermissionServiceImpl.java of the component URL Handler. Performing a manipulation results in improper authorization. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Database specific 
{
    "cwe_ids": [
        "CWE-266",
        "CWE-285"
    ],
    "cna_assigner": "VulDB",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2141.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "11.3.0"
                },
                {
                    "last_affected": "11.3.0"
                },
                {
                    "introduced": "11.3.1"
                },
                {
                    "last_affected": "11.3.1"
                },
                {
                    "introduced": "11.3.2"
                },
                {
                    "last_affected": "11.3.2"
                },
                {
                    "introduced": "11.3.3"
                },
                {
                    "last_affected": "11.3.3"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/wukongopensource/wukongcrm-11.0-web-java

Affected ranges

Type
GIT
Repo
https://github.com/wukongopensource/wukongcrm-11.0-web-java
Events
Introduced
48bcd6005a4d7b6fb57957e6eb71344b1c9c1189
Last affected
0a6f2306edcd5efa5282890a66cb42151e99b825
Database specific 
{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:5kcrm:wukong_crm:*:*:*:*:java:*:*:*",
    "extracted_events": [
        {
            "introduced": "11.0"
        },
        {
            "last_affected": "11.3.3"
        }
    ]
}

Affected versions

v11.*
v11.0.2
v11.1.0
v11.2.0
v11.3.1
v11.3.2
v11.3.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-2141.json"