CVE-2026-108708: Missing Authorization in WuKongOpenSource Wukong_HRM

The vulnerability in Wukong_HRM arises from improper authorization logic where EmployeeAspect grants HR administrator privileges to all authenticated users, and EmployeeUtil fails to restrict data scope, exposing all employee records. This enables unauthorized access and modification of sensitive HR data and destructive actions such as deleting critical organizational entities. The issue affects version 0 of the product and has a CVSS 4.0 base score of 8.7, indicating high severity. No patch or remediation details are provided in the available data.

Any authenticated user with low privileges can escalate their access to HR administrator level, allowing them to read confidential employee information (payslips, salary, bank cards, personal data), modify bank card details, and delete employees, departments, and contracts throughout the company. This can lead to significant data breaches, financial fraud, and operational disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected Wukong_HRM system to trusted users only and monitor for suspicious activity. Avoid granting unnecessary authentication access to untrusted users.