Wukong_HRM Authentication Bypass Grants Admin Access Without Token

A critical authentication bypass vulnerability has been identified in Wukong_HRM, an open-source human resources management platform. The flaw, tracked as CVE-2026-108707, allows unauthenticated attackers to gain full administrative access to the system without providing valid credentials. This discovery highlights a severe security gap in the software’s request handling mechanism.

At a glance

CVE

CVE-2026-108707

Product

WuKongOpenSource Wukong_HRM

CVSS

9.3 Critical

Weakness

improper authentication

Exploited

No known exploitation

The vulnerability stems from a logic error in the ParamAspect component of the application. According to the National Vulnerability Database record, the issue affects Wukong_HRM versions up to commit 186115e1a5a0b827ad9596ff8c2f3a876fb0cc55. The flaw is classified under CWE-287, which relates to improper authentication. An attacker can exploit this weakness simply by omitting the AUTH-TOKEN header from API requests.

Technical Context and Impact

The National Vulnerability Database assigns a CVSS score of 9.3 to CVE-2026-108707, placing it in the Critical severity range. This high score reflects the ease of exploitation and the significant impact on confidentiality, integrity, and availability. The vulnerability allows remote attackers to call every HRM API endpoint without any form of authentication. This means that no valid user session or token is required to interact with the system’s backend services.

Once an attacker bypasses the authentication check, they gain HR administrator-level privileges. This access enables them to read sensitive employee information, including payslips and salary history. Attackers can also download attachments stored within the system and modify or delete company-wide HR records. The ability to alter or destroy data poses a severe operational and compliance risk to organizations using the software.

Affected Versions and Scope

The vulnerability affects WuKongOpenSource Wukong_HRM through commit 186115e1a5a0b827ad9596ff8c2f3a876fb0cc55. Any deployment running these versions or earlier is potentially exposed to unauthorized access. The flaw is inherent in the codebase up to this specific commit, meaning that patches or updates released after this point may address the issue. Organizations using older builds must verify their current version against this identifier.

The impact extends beyond data theft to include data manipulation. Since attackers can modify or delete records, the integrity of HR data is compromised. This could lead to incorrect payroll processing, loss of historical employment data, and potential legal liabilities. The open-source nature of Wukong_HRM means that many organizations may be using self-hosted instances, increasing the attack surface if proper network segmentation is not in place.

What should you do?

No official fix or patch has been confirmed yet for CVE-2026-108707. Organizations using Wukong_HRM should assume that their instances are vulnerable if they are running versions up to commit 186115e. Immediate action is required to limit exposure. Administrators should review access logs for any suspicious activity that lacks authentication tokens. Isolating the HR application from public-facing networks can reduce the risk of remote exploitation until a vendor update is available.

What to do and how to stay safe: Wukong_HRM

• Verify the current commit version of Wukong_HRM against 186115e1a5a0b827ad9596ff8c2f3a876fb0cc55 to determine if your instance is affected.
• Monitor server logs for API requests that lack the AUTH-TOKEN header, which may indicate exploitation attempts or successful breaches.
• Restrict network access to the Wukong_HRM application using firewalls or network segmentation to prevent unauthenticated external connections.
• Prepare to apply updates immediately once the vendor releases a patch addressing CVE-2026-108707 in future commits.

Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-108707?

The CVSS score for CVE-2026-108707 is 9.3, which is rated as Critical severity.

Which versions of Wukong_HRM are affected by this vulnerability?

Wukong_HRM versions up to commit 186115e1a5a0b827ad9596ff8c2f3a876fb0cc55 are affected.

How can an attacker exploit this authentication bypass?

An attacker can exploit the vulnerability by omitting the AUTH-TOKEN header when calling HRM API endpoints.