{"vulnerability": "CVE-2026-108707", "sightings": [{"uuid": "48726469-0dd3-4997-b4bf-6530c25aa8a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-108707", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mxkz6f7eu62a", "content": "CRITICAL auth bypass in WuKong_HRM (\u2264 commit 186115e): attackers can access all APIs as admin, risking HR data. Restrict endpoints and monitor logs until a fix is confirmed. https://radar.offseq.com/threat/cve-2026-108707-improper-authentication-in-wukongopensource-wukonghrm-13cec42117273b1c #Off...", "creation_timestamp": "2026-10-11T03:00:30.624623Z"}, {"uuid": "323f86e7-c719-4e3c-973e-eb40467425a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108707", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419794679250382", "content": "CVE-2026-108707 Wukong_HRM through commit 186115e Authentication Bypass via ParamAspect Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header. Attackers gain HR administrator access to read payslips, salary history and employee personal data, download attachments, and modify or delete company-wide HR records.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108707https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/Wukong_HRM/poc_salary_slip_detail_read.pyhttps://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/Wukong_HRM/poc_employee_export_pii.pyhttps://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/Wukong_HRM/poc_attachment_download_idor.pyhttps://github.com/WuKongOpenSource/Wukong_HRM/blob/186115e1a5a0b827ad9596ff8c2f3a876fb0cc55/common/common-web/src/main/java/com/kakarote/core/config/ParamAspect.java#L35-L55https://github.com/WuKongOpenSource/Wukong_HRM/blob/186115e1a5a0b827ad9596ff8c2f3a876fb0cc55/hrm/hrm-web/src/main/java/com/kakarote/hrm/common/EmployeeAspect.java#L28-L45https://www.vulncheck.com/advisories/wukong-hrm-through-commit-186115e-authentication-bypass-via-paramaspect#WuKongOpenSource #Wukong_HRM#CVE_2026_108707#bot", "creation_timestamp": "2026-10-11T01:57:59.258055Z"}, {"uuid": "ffc30f02-ff42-47e0-8614-1ef2acc24219", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108707", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxkxhy5v3h27", "content": "CVE-2026-108707\nThe Wukong HRM system can be accessed without a valid login token, allowing anyone on the network to call its HR APIs. This lets an attacker read payslips, salary history, personal employee information,\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-10-11T02:30:04.770794Z"}, {"uuid": "8d2fa812-7323-4179-b647-039ea6573d76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-108707", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117420040385406970", "content": "CRITICAL: CVE-2026-108707 in WuKong_HRM (\u2264 commit 186115e) enables auth bypass \u2014 attackers can access all HRM APIs, gaining admin rights and exposing sensitive HR data. Restrict endpoints & monitor for unauthorized access. https://radar.offseq.com/threat/cve-2026-108707-improper-authentication-in-wukongopensource-wukonghrm-13cec42117273b1c #OffSeq #CVE2026108707 #infosec #vulnerability", "creation_timestamp": "2026-10-11T03:00:28.699005Z"}, {"uuid": "69fcc7e3-db95-43d4-af9f-8521c05c0674", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108707", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxl4vmeci42l", "content": "\ud83d\udea8 CVE-2026-108707 \u2014 CVSS 9.3 CRITICAL\n\nWukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allow...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-108707\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-11T04:07:10.538382Z"}, {"uuid": "c53a6eb0-c264-4a6d-8e95-376c1c382826", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108707", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117421943609381322", "content": "CVE-2026-108707 - Critical Auth Bypass in Wukong_HRM allows full API takeover & sensitive HR data theft. CVSS 9.8. Restrict API access immediately. #CVE #infosec #cybersecurity\nhttps://www.valtersit.com/cve/CVE-2026-108707/", "creation_timestamp": "2026-10-11T11:04:44.554585Z"}]}