CVE-2026-108708

Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil data-scope checks return all employees. Any authenticated low-privileged employee can read payslips, salary records, bank cards and personal data, edit bank cards, and delete employees, departments and contracts company-wide.

Any authenticated low-privileged employee can access sensitive financial and personal data of all employees and modify or delete critical HR records, causing a serious breach of confidentiality and integrity.

Immediately update Wukong_HRM to a patched version or apply authorization fixes in EmployeeAspect and EmployeeUtil, and until then restrict HR functions to authorized administrators only.