{"id":"CVE-2026-108708","published":"2026-10-11T02:16:39.650","lastModified":"2026-10-16T19:18:44.867","description":"Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil data-scope checks return all employees. Any authenticated low-privileged employee can read payslips, salary records, bank cards and personal data, edit bank cards, and delete employees, departments and contracts company-wide.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/Wukong_HRM/poc_payroll_card_social_security.py","tags":[]},{"url":"https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/Wukong_HRM/poc_salary_archives_history.py","tags":[]},{"url":"https://github.com/WuKongOpenSource/Wukong_HRM/blob/186115e1a5a0b827ad9596ff8c2f3a876fb0cc55/hrm/hrm-web/src/main/java/com/kakarote/hrm/common/EmployeeAspect.java#L28-L45","tags":[]},{"url":"https://github.com/WuKongOpenSource/Wukong_HRM/blob/186115e1a5a0b827ad9596ff8c2f3a876fb0cc55/hrm/hrm-web/src/main/java/com/kakarote/hrm/utils/EmployeeUtil.java#L33-L132","tags":[]},{"url":"https://www.vulncheck.com/advisories/wukong-hrm-through-commit-186115e-missing-authorization-via-employeeaspect-and-employeeutil","tags":[]}],"exploitRefs":[{"url":"https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/Wukong_HRM/poc_payroll_card_social_security.py","tags":[]},{"url":"https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/Wukong_HRM/poc_salary_archives_history.py","tags":[]},{"url":"https://github.com/WuKongOpenSource/Wukong_HRM/blob/186115e1a5a0b827ad9596ff8c2f3a876fb0cc55/hrm/hrm-web/src/main/java/com/kakarote/hrm/common/EmployeeAspect.java#L28-L45","tags":[]},{"url":"https://github.com/WuKongOpenSource/Wukong_HRM/blob/186115e1a5a0b827ad9596ff8c2f3a876fb0cc55/hrm/hrm-web/src/main/java/com/kakarote/hrm/utils/EmployeeUtil.java#L33-L132","tags":[]}],"hasPoc":true,"ai":{"summary":"The Wukong_HRM system has a critical authorization flaw where any authenticated employee can assume the role of HR administrator and access sensitive employee data including payslips, salary records, and personal information across the entire company. This allows low-privileged users to perform high-privilege actions like editing bank cards and deleting employees, departments, and contracts.","exploitability":"Exploitation is straightforward for any authenticated user with minimal prerequisites - they simply need to access the EmployeeAspect functionality which incorrectly assigns HR administrator privileges to all callers, making the vulnerability easy to trigger without specialized tools or conditions.","blast_radius":"The impact could be severe as attackers could access and potentially manipulate sensitive employee financial data, personal information, and organizational structure, potentially leading to identity theft, financial fraud, and operational disruption across the entire company.","remediation":"Implement proper authorization checks in EmployeeAspect to prevent role assignment bypass and ensure data-scope validation returns only relevant employee records instead of all employees. Upgrade to version 2.590 or later which contains the fixed authorization implementation.","detection":"Monitor for unauthorized access patterns to HR-related endpoints, particularly when low-privilege users access payroll and employee management functions that should be restricted to HR administrators. Look for unusual data access logs showing cross-departmental employee record queries and modifications.","tags":["authorization","hrm","data-exfiltration","privilege-escalation"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:53:30.964Z"}}