WuKongOpenSource Wukong HRM vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting WuKongOpenSource Wukong HRM: 2 record(s), with affected versions and fixes.

CVE-2026-108708 High · 8.8 CWE-862 Oct 10, 2026

Wukong_HRM through commit 186115e Missing Authorization via EmployeeAspect and EmployeeUtil

Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil data-scope checks return all employees. Any authenticated low-privileged employee can read payslips, salary records, bank cards and personal data, edit bank cards, and delete employees, departments and contracts company-wide.

CVE-2026-108707 Critical · 9.8 CWE-287 Oct 10, 2026

Wukong_HRM through commit 186115e Authentication Bypass via ParamAspect

Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header. Attackers gain HR administrator access to read payslips, salary history and employee personal data, download attachments, and modify or delete company-wide HR records.