CVE-2026-108796: Authorization Bypass in ZKTeco BioTime

This vulnerability affects ZKTeco BioTime 9.5.6 Build 20260130.3206 in the biometric data endpoint component. An attacker can remotely manipulate the emp_code argument in the /iclock/finger_data/ endpoint to bypass authorization mechanisms. The vendor was contacted but did not provide any response or remediation guidance. No known exploits are reported in the wild, and no official patch or fix has been disclosed.

Successful exploitation allows an attacker with network access to bypass authorization controls in the biometric data endpoint, potentially granting unauthorized access to sensitive biometric data or functionality. The impact is rated medium based on the CVSS 4.0 score of 5.3, indicating a moderate risk that could affect confidentiality or integrity of biometric data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch or workaround is publicly available, organizations should consider restricting network access to the affected endpoint and monitor for suspicious activity related to the emp_code parameter until an official fix is released.