CVE-2026-108708 — Wukong_HRM through commit 186115e Missing Authorization via EmployeeAspect and EmployeeUtil
Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil data-scop…
Published: 2026-10-11 · CVSS: 8.7 · CVSS 4.0
Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil data-scope checks return all employees. Any authenticated low-privileged employee can read payslips, salary records, bank cards and personal data, edit bank cards, and delete employees, departments and contracts company-wide.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7