CVE-2026-108708— Wukong_HRM through commit 186115e Missing Authorization via EmployeeAspect and EmployeeUtil
Quick assessment
Affected
WuKongOpenSource Wukong_HRM
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Wukong_HRM（在提交 186115e 版本中）存在一个缺失的授权漏洞。原因是 EmployeeAspect 将所有调用者赋予了 HR 管理员角色，并且 EmployeeUtil 中的数据范围检查返回所有员工的数据。任何经过身份验证的低权限员工都可以读取工资单、薪资记录、银行卡和个人信息，编辑银行卡，并删除整个公司的员工、部门和合同信息。
Possible ATT&CK Techniques 3 AI
T1098 · Account Manipulation T1068 · Exploitation for Privilege Escalation T1078 · Valid Accounts
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-108708
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Wukong_HRM through commit 186115e Missing Authorization via EmployeeAspect and EmployeeUtil
Source: CVE Program / CVE List V5
Vulnerability Description
Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil data-scope checks return all employees. Any authenticated low-privileged employee can read payslips, salary records, bank cards and personal data, edit bank cards, and delete employees, departments and contracts company-wide.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| WuKongOpenSource | Wukong_HRM | 0 ~ 186115e1a5a0b827ad9596ff8c2f3a876fb0cc55 | - |
|
II. Public POCs for CVE-2026-108708
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-108708
请登录查看更多情报信息。
Other References for CVE-2026-108708 (5)
-
Unicorn! · GitHub exploit
-
Unicorn! · GitHub technical-description
-
Unicorn! · GitHub technical-description
-
Unicorn! · GitHub exploit
Same Patch Batch · WuKongOpenSource · 2026-10-11 · 3 CVEs total
| CVE-2026-108707 | 9.8 CRITICAL | Wukong_HRM through commit 186115e Authentication Bypass via ParamAspect |
| CVE-2026-108689 | 5.4 MEDIUM | Wukong AICRM through 20260610 Authorization Bypass via User-Controlled Session ID in POST |
IV. Related Vulnerabilities
Same vendor: WuKongOpenSource
-
CVE-2026-108707
Wukong_HRM through commit 186115e Authentication Bypass via -
CVE-2026-108689
Wukong AICRM through 20260610 Authorization Bypass via User- -
CVE-2026-2141
WuKongOpenSource WukongCRM URL PermissionServiceImpl.java im -
CVE-2025-8852
WuKongOpenSource WukongCRM API Response upload information e -
CVE-2025-6106
WuKongOpenSource WukongCRM AdminRoleController.java cross-si
Same weakness: CWE-862
-
CVE-2026-108706
eladmin through commit 55fbf70 Missing Authorization via S3 -
CVE-2026-108705
CordysCRM through 1.9.3 Missing Authorization via /custom-fo -
CVE-2026-108703
CordysCRM through 1.9.3 Missing Authorization via /approval- -
CVE-2026-108702
CordysCRM through 1.9.3 Missing Authorization and Blind SSRF -
CVE-2026-108701
1Panel-dev CordysCRM before 1.9.2 Missing Authorization via
V. Comments for CVE-2026-108708
No comments yet