{"uuid": "b76f92a1-9f13-4b34-b6f9-877a52cc659a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108708", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419797317523218", "content": "CVE-2026-108708 Wukong_HRM through commit 186115e Missing Authorization via EmployeeAspect and EmployeeUtil Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil data-scope checks return all employees. Any authenticated low-privileged employee can read payslips, salary records, bank cards and personal data, edit bank cards, and delete employees, departments and contracts company-wide.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108708https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/Wukong_HRM/poc_salary_archives_history.pyhttps://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/Wukong_HRM/poc_payroll_card_social_security.pyhttps://github.com/WuKongOpenSource/Wukong_HRM/blob/186115e1a5a0b827ad9596ff8c2f3a876fb0cc55/hrm/hrm-web/src/main/java/com/kakarote/hrm/common/EmployeeAspect.java#L28-L45https://github.com/WuKongOpenSource/Wukong_HRM/blob/186115e1a5a0b827ad9596ff8c2f3a876fb0cc55/hrm/hrm-web/src/main/java/com/kakarote/hrm/utils/EmployeeUtil.java#L33-L132https://www.vulncheck.com/advisories/wukong-hrm-through-commit-186115e-missing-authorization-via-employeeaspect-and-employeeutil#WuKongOpenSource #Wukong_HRM#CVE_2026_108708#bot", "creation_timestamp": "2026-10-11T01:58:39.601536Z"}