Wukongopensource Wukong HRM vulnerabilities
2 vulnerabilities
Known vulnerabilities in Wukongopensource Wukong HRM, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
PrioritiseCVE-2026-108708wukongopensource · wukong_hrmWukong_HRM through commit 186115e Missing Authorization via EmployeeAspect and EmployeeUtilWukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil data-scope checks return all employees. Any authenticated low-privileged employee can read payslips, salary records, bank cards and personal data, edit bank cards, and delete employees, departments and contracts company-wide.CVSS8.8HighEPSS0.28%PrioritiseCVE-2026-108707wukongopensource · wukong_hrmWukong_HRM through commit 186115e Authentication Bypass via ParamAspectWukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header. Attackers gain HR administrator access to read payslips, salary history and employee personal data, download attachments, and modify or delete company-wide HR records.CVSS9.8CriticalEPSS0.55%