Wukong_HRM ParamAspect Flaw CVE-2026-108707 Lets Remote Attackers Access All HR Endpoints Unauthenticated

An authentication bypass vulnerability in the open-source human resources management system Wukong_HRM allows remote attackers to gain full administrative access without valid credentials. The National Vulnerability Database assigned the flaw CVE-2026-108707 and rated it Critical with a CVSS score of 9.3. The issue stems from improper access control within the ParamAspect component, which fails to validate authentication tokens correctly. This defect enables unauthenticated users to interact with the system as if they were authorized administrators, creating a severe security risk for organizations relying on this software for sensitive personnel management.

The risk

The core of the vulnerability, classified under CWE-287 for improper authorization, allows attackers to call every HRM API endpoint by simply omitting the AUTH-TOKEN header. According to the NVD record, this omission tricks the system into granting full access. Attackers can read sensitive employee information including payslips, salary history, and personal data without any form of login. They can also download attachments stored within the system, potentially exposing confidential documents. Furthermore, malicious actors can modify or delete company-wide HR records, leading to data integrity issues and potential operational disruption for the affected organization.

Who is exposed

The vulnerability affects WuKongOpenSource Wukong_HRM installations up to commit 186115e1a5a0b827ad9596ff8c2f3a876fb0cc55. Any organization running this specific version or earlier commits is potentially exposed to unauthorized access. Small businesses and enterprises using this open-source HR platform for managing employee records are at direct risk. The exposure is particularly severe because the attack vector is remote and requires no initial authentication, making it easily exploitable by automated scanning tools or targeted attackers. Systems connected to the internet without additional network-level protections are most vulnerable to this type of exploitation.

Cost and compliance

The breach of employee personal data and salary history through this vulnerability could trigger significant regulatory compliance issues. Organizations may face penalties under data protection laws if they fail to safeguard sensitive personnel information. The ability for attackers to modify or delete HR records introduces financial and legal liabilities related to payroll errors and employment disputes. While the source material does not specify exact financial costs, the potential for data leakage and system compromise implies substantial remediation expenses. Companies must assess their exposure to ensure they meet legal obligations regarding the protection of employee data.

What to watch

Security teams should monitor for unusual API activity that lacks authentication headers but results in successful data retrieval. Look for unauthorized access attempts to HR endpoints that bypass normal login procedures. Verify that your Wukong_HRM installation is not running the vulnerable commit range. Check server logs for requests that omit the AUTH-TOKEN header, as this is the primary indicator of exploitation attempts. Early detection of these patterns can help limit the scope of data exposure before significant damage occurs.

Background: Authentication bypass vulnerabilities

Authentication bypass vulnerabilities arise from logic flaws, improper session handling, and misconfigured permissions. These mistakes let attackers access data without valid credentials. Fixing them requires strict input validation, secure session management, and regular vulnerability scanning to identify weak points before exploitation.

Read the full guide: Authentication Bypass Mistakes That Leave Systems Exposed

What to do and how to stay safe: Wukong_HRM

• Verify the current commit version of your Wukong_HRM installation to determine if it falls within the vulnerable range up to 186115e.
• Implement network-level access controls to restrict API endpoints to trusted IP addresses or internal networks only.
• Monitor server logs for requests that omit authentication headers, which indicate potential exploitation attempts.
• Ensure that sensitive employee data is encrypted at rest to mitigate the impact of unauthorized access.

Step-by-step guide: Vulnerability Prioritization: Fix What Actually Matters First

General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-108707?

The National Vulnerability Database rates CVE-2026-108707 as Critical with a CVSS score of 9.3.

How do attackers exploit this vulnerability?

Attackers exploit the flaw by omitting the AUTH-TOKEN header when calling HRM API endpoints, bypassing authentication.

Which versions of Wukong_HRM are affected?

WuKongOpenSource Wukong_HRM up to commit 186115e1a5a0b827ad9596ff8c2f3a876fb0cc55 is affected by this vulnerability.