Wukong Hrm Through Commit 186115e Missing Authorization Via Employeeaspect And Employeeutil

Back www.vulncheck.com

Wukong Hrm Through Commit 186115e Missing Authorization Via Employeeaspect And Employeeutil

www.vulncheck.com • October 11, 2026

Share: View original

Wukong_HRM through commit 186115e Missing Authorization via EmployeeAspect and EmployeeUtil

Wukong_HRM <= 186115e1a5a0b827ad9596ff8c2f3a876fb0cc55

Wukong_HRM <= 186115e1a5a0b827ad9596ff8c2f3a876fb0cc55

CWE-862 Missing Authorization

Researcher Proof of Concept (salary history)

Researcher Proof of Concept (salary card and social security)

Vulnerable Code: EmployeeAspect (commit 186115e)

Vulnerable Code: EmployeeUtil data scope (commit 186115e)

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

High-Risk CVE-2026-108708 in Wukong_HRM Exposes Sensitive Employee Data A missing authorization vulnerability in Wukong_HRM, identified as CVE-2026-108708, allows low-privileged employees to access sensitive payroll information, including payslips and bank details. The flaw arises from commit 186115e, where EmployeeAspect improperly grants HR administrator roles to all callers, and EmployeeUtil fails to restrict data access. Organizations using self-hosted HR platforms are at high risk, particularly if the service is internet-accessible. Proof-of-concept material exists, but active exploitation status remains unknown. Immediate action is recommended to mitigate potential data breaches and unauthorized changes. Security teams should review access logs and restrict network access to trusted users. 1 sources 65

Extracted Entities

CWE Weaknesses (1)

CWE-862 - Missing Authorization

SHA1 Hashes (1)

186115e1a5a0b827ad9596ff8c2f3a876fb0cc55

Vulnerabilities (1)

Missing Authorization