CVE-2026-108708 Details
Description
Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil data-scope checks return all employees. Any authenticated low-privileged employee can read payslips, salary records, bank cards and personal data, edit bank cards, and delete employees, departments and contracts company-wide.
A missing authorization vulnerability has been identified in Wukong HRM, specifically in versions through commit 186115e. The issue arises because the EmployeeAspect component automatically assigns the HR administrator role to all callers. Consequently, EmployeeUtil's data-scope checks erroneously grant access to all employee records. This flaw allows any authenticated low-privileged employee to access sensitive information such as payslips, salary records, bank card details, and personal data. Additionally, affected individuals can modify bank card information and delete employees, departments, and contracts across the company.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 11, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Wukong_HRM | <= 186115e1a5a0b827ad9596ff8c2f3a876fb0cc55 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 11, 2026 | New CVE Received | [email protected] |