Wukong_HRM Critical Auth Bypass CVE-2026-108707 Exposes Employee Data and Admin Controls Without Credentials

The open-source human resources management system Wukong_HRM contains a severe authentication bypass vulnerability. According to the National Vulnerability Database, this flaw allows unauthenticated attackers to gain full administrative access. The issue stems from improper validation in the ParamAspect component, which fails to enforce security checks when specific headers are missing from API requests.

In plain English

The vulnerability exists because the software does not verify user credentials when the AUTH-TOKEN header is absent from incoming requests. Instead of rejecting these unauthenticated attempts, the system processes them as valid administrative actions. This means anyone with network access to the server can interact with every API endpoint. They do not need to guess passwords or exploit complex logic flaws to gain entry into the system.

The background

The National Vulnerability Database assigned CVE-2026-108707 to this issue, rating it as critical with a CVSS score of 9.3. The weakness is classified under CWE-287, indicating an improper authorization mechanism. The flaw affects all Wukong_HRM versions up to and including commit 186115e1a5a0b827ad9596ff8c2f3a876fb0cc55. No later versions are confirmed to be safe or fixed in the current reporting materials.

What changes now

Organizations using Wukong_HRM face immediate risk to sensitive personnel data. Attackers can read payslips, view salary history, and download employee attachments without any authentication. They can also modify or delete company-wide HR records, potentially disrupting payroll operations and data integrity. Security teams must treat this as an urgent operational threat requiring immediate containment or remediation efforts.

Background: Authentication bypass vulnerabilities

Enforce server-side session validation for every request. Use short-lived tokens with strict scope. Implement multi-factor authentication to block credential theft. Remove client-side logic that makes access decisions. Audit your code for logic flaws that skip verification steps.

Read the full guide: Stop Authentication Bypass Vulnerabilities with Priority Controls

What to do and how to stay safe: Wukong_HRM

• Verify if your organization runs Wukong_HRM versions up to commit 186115e1a5a0b827ad9596ff8c2f3a876fb0cc55.
• Monitor network logs for API requests that lack the AUTH-TOKEN header to detect unauthorized access attempts.
• Restrict external access to HRM API endpoints using firewalls or web application firewalls until a fix is available.
• Audit recent administrative changes in the HR system to identify potential data tampering or unauthorized deletions.

Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits

General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-108707?

The National Vulnerability Database rates CVE-2026-108707 as critical with a CVSS score of 9.3.

How do attackers exploit this vulnerability?

Attackers exploit the flaw by omitting the AUTH-TOKEN header when calling Wukong_HRM API endpoints, bypassing authentication checks.

Which versions of Wukong_HRM are affected?

All Wukong_HRM versions up to commit 186115e1a5a0b827ad9596ff8c2f3a876fb0cc55 are affected by this authentication bypass vulnerability.