CVE-2026-108707
CriticalCVSS 9.8Summary
Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header. Attackers gain HR administrator access to read payslips, salary history and employee personal data, download attachments, and modify or delete company-wide HR records.
Risk Assessment
An unauthenticated attacker can gain full administrative access to the HR system, leading to leakage of personal and salary data and the ability to modify or delete HR records company-wide.
Recommendation
Immediately update Wukong_HRM to a patched version or apply a workaround enforcing AUTH-TOKEN validation, and until then restrict access to the HRM API to trusted networks only.
Other vulnerabilities in Wukong_HRM
Original NVD description (English source)
Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header. Attackers gain HR administrator access to read payslips, salary history and employee personal data, download attachments, and modify or delete company-wide HR records.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS