Orgs Hit Hard: Wukong_HRM CVE-2026-108707 Allows Unauthenticated Access to All HR Endpoints and Record Deletion
A critical authentication bypass in Wukong_HRM allows unauthenticated remote attackers to access all HR endpoints and modify employee records without credentials.
Key points
- CVE-2026-108707 carries a CVSS score of 9.3, rated as Critical by the National Vulnerability Database.
- The flaw resides in the ParamAspect component and affects Wukong_HRM versions up to commit 186115e.
- Attackers can read payslips, download attachments, and delete company-wide HR records without providing any authentication token.
The risk
The National Vulnerability Database published CVE-2026-108707 on 2026-02-18, identifying a severe authentication bypass in Wukong_HRM. The vulnerability exists within the ParamAspect component of the software. According to the NVD record, attackers can exploit this flaw by simply omitting the AUTH-TOKEN header from their requests. This action tricks the system into granting full access to every HRM API endpoint.
This authentication failure allows unauthenticated remote attackers to gain HR administrator privileges. The NVD description states that exploiters can read sensitive employee data, including payslips and salary history. Attackers can also download attachments associated with employee files. Furthermore, the vulnerability permits the modification or deletion of company-wide HR records. The National Vulnerability Database assigns a CVSS score of 9.3 to this issue.
Who is exposed
The vulnerability affects Wukong_HRM software developed by WuKongOpenSource. According to the NVD record, all versions of Wukong_HRM up to commit 186115e1a5a0b827ad9596ff8c2f3a876fb0cc55 are vulnerable. Organizations using this open-source human resources management system are at immediate risk. The flaw is classified under CWE-287, which denotes improper authentication.
Small businesses relying on Wukong_HRM for payroll and personnel management face significant exposure. The lack of required authentication means any external actor can interact with the system. The NVD record confirms that the attack vector is network-based and requires no user interaction. This makes the system accessible to automated scanning tools and malicious actors targeting unpatched instances.
Cost and compliance
The potential for data breach is severe given the nature of the exposed information. Attackers can access salary history and personal employee data. The ability to modify or delete HR records introduces operational risk and potential legal liability. Compliance frameworks such as GDPR or CCPA may require notification if personal data is accessed without authorization. The NVD record highlights the critical severity of the data exposure.
What happens next
Organizations should verify their Wukong_HRM version immediately. Check if the installation is at or below commit 186115e. Monitor network logs for requests missing the AUTH-TOKEN header. Isolate affected systems from public networks if possible. No patch has been confirmed yet by the vendor.
Background: National Vulnerability Database
The National Vulnerability Database is a centralized repository that standardizes information about software weaknesses. It assigns unique identifiers to each flaw, allowing security tools to automatically detect and assess risks in your systems without manual research.
Read the full guide: National Vulnerability Database Explained: How NVD Works for You
What to do and how to stay safe: Wukong_HRM
- Audit all instances of Wukong_HRM to determine if they run versions prior to the affected commit.
- Restrict network access to the HR application firewall rules to block untrusted external IP addresses.
- Monitor server logs for API requests that lack authentication headers to detect active exploitation attempts.
- Prepare an incident response plan for potential exposure of payroll and personal employee data.
Step-by-step guide: Vulnerability Prioritization: Fix What Actually Breaks Your Business
General security guidance from the CloudSec Pulse newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-108707?
The National Vulnerability Database rates CVE-2026-108707 with a CVSS score of 9.3, which is classified as Critical.
How do attackers exploit this Wukong_HRM vulnerability?
Attackers exploit the flaw by omitting the AUTH-TOKEN header from their requests to the ParamAspect component.
Which versions of Wukong_HRM are affected by this flaw?
Wukong_HRM versions up to commit 186115e1a5a0b827ad9596ff8c2f3a876fb0cc55 are vulnerable to this authentication bypass.
