What happened
Wukong AICRM through 20260610 accepts an arbitrary sessionId on POST /chat/send and returns streamed assistant replies constructed from the victim's recent messages. An authenticated user can thus write into — and read back — another user's AI CRM chat session, disclosing conversation content and polluting it.
Why it matters
AI CRM chats carry prospect/customer intelligence. This IDOR lets a sales colleague (or an attacker with any valid user account) silently read a colleague's private AI chat thread and inject content that misleads the victim's decision-support model output.
Attack vector
Authenticated user supplies an arbitrary sessionId to POST /chat/send without ownership checks — appending messages to the victim's conversation and receiving streamed assistant replies built from the victim's last ~20 messages, disclosing conversation content.
Affected systems
Wukong AICRM <= 20260610 (POST /chat/send, sessionId-controlled)
Mitigation
No released fix at publication; enforce server-side session ownership on /chat/send (VulnCheck advisory).