Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil data-scope checks return all employees. Any authenticated low-privileged employee can read payslips, salary records, bank cards and personal data, edit bank cards, and delete employees, departments and contracts company-wide.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
🔐CVE-2026-108707 | CVSS 9.8 Wukong_HRM — omit the AUTH-TOKEN header, get full HR admin access. No credentials required. Companion CVE-2026-108708 (8.8): even a low-privileged employee escalates to HR admin automatically. https://threataft.com/articles/wukong-hrm-authentication-bypass-cve-2026-108707 #CVE #CyberSecurity #HRM