CVE-2026-108707 WuKongOpenSource CVE debrief

Who should care

HR administrators, IT teams, and security professionals responsible for Wukong HRM systems should assess exposure and prioritize remediation to prevent unauthorized access to sensitive employee data.

Why it matters

CVE-2026-108707 is a critical authentication bypass vulnerability in Wukong HRM that allows unauthenticated attackers to access HRM API endpoints, read sensitive employee data, and modify HR records. Defenders should assess exposure, prioritize remediation, and verify HRM system configurations to prevent unauthorized access.

• Read sensitive employee data, including payslips and salary history
• Modify or delete company-wide HR records
• Download attachments containing sensitive employee data
• Gain HR administrator access to HRM API endpoints

Technical summary

The vulnerability is caused by a missing AUTH-TOKEN header check in ParamAspect, allowing unauthenticated attackers to access HRM API endpoints. PoCs demonstrate exploitation of this vulnerability to read sensitive employee data and modify HR records. The affected product is Wukong HRM, and defenders should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. The vulnerability has a CVSS score of 9.3 and a critical severity level, indicating a high impact on confidentiality, integrity, and availability.

Defensive priority

High

Recommended defensive actions

• Assess exposure by verifying HRM system configurations and access controls
• Prioritize remediation of the authentication bypass vulnerability
• Verify HRM system configurations and access controls to prevent unauthorized access
• Monitor HRM system logs for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source references provide details on the vulnerability, including PoCs and affected code. However, the vendor and affected versions are not clearly identified, requiring further verification.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.