CVE Alert: CVE-2026-108708 – WuKongOpenSource – Wukong_HRM

Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil data-scope checks return all employees. Any authenticated low-privileged employee can read payslips, salary records, bank cards and personal data, edit bank cards, and delete employees, departments and contracts company-wide.

**Risk verdict:** High-priority exposure for any reachable deployment: proof-of-concept material exists, but active exploitation status is unknown, so urgency should be raised if the service is internet-accessible or suspicious activity is found.

**Why this matters:** A compromised or malicious employee account could expose highly sensitive workforce and payroll information, creating privacy, fraud and regulatory risks. Unauthorised changes or deletions could also disrupt HR operations and undermine the integrity of employee records.

**Most likely attack path:** An attacker needs network access and a valid, low-privilege account; no victim interaction or complex setup is required. The flaw can turn that account into broad HR access, but the unchanged scope suggests impact is within the vulnerable application rather than automatically extending to other systems.

**Who is most exposed:** Organisations running self-hosted HR platforms, especially those reachable by staff or the public and holding payroll, identity or banking data. Exposure is greater where employee accounts are easy to obtain or shared.

Review audit logs for employee accounts accessing records outside their normal remit.

Alert on bulk payslip, salary, banking or personal-data reads and exports.

Investigate unexpected edits to payment details and deletions of staff, departments or contracts.

Check application logs for authorization failures, unusual API access and high-volume requests.

Mitigation and prioritisation

Identify affected deployments and apply a vendor-confirmed fix; verify authorization and data-scope checks afterwards.

Restrict network access to trusted users and disable the service if exposure cannot be controlled promptly.

Review recent access and changes; preserve logs and investigate possible data exposure or tampering.

Require revalidation of bank-detail changes and restore deleted records from trusted backups where needed.

EPSS and active-exploitation flags are not provided; obtain them to refine urgency.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.