CVE-2026-108797: Authorization Bypass in ZKTeco BioTime

This vulnerability exists in the Employee REST API component of ZKTeco BioTime 9.5.6 Build 20260130.3206. Specifically, the endpoint /personnel/api/employees/ contains an authorization bypass flaw that can be exploited remotely by attackers with low privileges. The flaw allows unauthorized access to protected resources or operations by circumventing normal authorization checks. The vendor was contacted but did not provide any response or patch information. No known exploits are reported in the wild.

An attacker with limited privileges can remotely bypass authorization controls in the Employee REST API, potentially gaining unauthorized access to employee-related data or functionality. This could lead to unauthorized data exposure or manipulation within the affected system. The medium CVSS score reflects a moderate risk due to the ease of remote exploitation and the potential impact on sensitive employee information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, organizations should monitor official ZKTeco channels for updates. Until a patch is available, consider restricting access to the affected API endpoint and applying compensating controls such as network segmentation or additional authentication layers if feasible.