According to the NVD record, a critical authentication bypass in Wukong_HRM's ParamAspect component lets unauthenticated attackers call every HRM API endpoint with HR administrator privileges.
What Is It
CVE-2026-108707 is an authentication bypass (CWE-287) in Wukong_HRM, an open-source HR management system from WuKongOpenSource. According to the NVD record, the flaw is in the ParamAspect component. An attacker who leaves the AUTH-TOKEN header out of a request can call any HRM API endpoint without authenticating.
VulnCheck assigned the CVE and published it on 2026-10-11. The NVD record is still in "Received" status, which means NVD has not yet analyzed it.
Why It Matters
According to the vulnerability description, exploiting the flaw gives an attacker HR administrator access. The advisory says this would let them:
- Read payslips, salary history and employee personal data
- Download attachments
- Modify or delete company-wide HR records
VulnCheck scores it CVSS 3.1 9.8 (Critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Under that scoring, the flaw is reachable over the network, takes little effort, and needs no privileges or user interaction. VulnCheck's CVSS 4.0 score is 9.3 (Critical).
The NVD references include public proof-of-concept scripts covering attachment download, export of employee personal data, and reading salary slip details. Proof-of-concept code is publicly available, but these sources do not show whether it works against production deployments.
As of publication, the CVE is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and the available sources do not confirm active exploitation.
What's Vulnerable
- Vendor: WuKongOpenSource
- Product: Wukong_HRM
- Affected: All versions up to and including commit
186115e1a5a0b827ad9596ff8c2f3a876fb0cc55, per the NVD record
The references point to the relevant code in ParamAspect.java (common-web module) and EmployeeAspect.java (hrm-web module) at that commit.
Patch Status
The available records do not list a fixed version or commit. No CISA KEV required action applies because the CVE is not in the catalog.
If you run Wukong_HRM, check the project repository and the VulnCheck advisory for remediation updates. Until a fix is confirmed, treat any internet-facing instance as potentially exposed. The advisory says the bypass needs no credentials, and the published PoC scripts target sensitive HR data.
Sources
- NVD, CVE-2026-108707
- VulnCheck Advisory; Wukong_HRM Authentication Bypass via ParamAspect
- CISA Known Exploited Vulnerabilities Catalog
- Wukong_HRM, ParamAspect.java (affected code)
- Wukong_HRM, EmployeeAspect.java (affected code)
- PoC, Attachment download
- PoC, Employee PII export
- PoC, Salary slip detail read