Organisations Risk Total HR Data Loss as Wukong_HRM Flaw Grants Unauthenticated Admin Access via CVE-2026-108707

Organisations using the open-source human resources management system Wukong_HRM face severe exposure due to a critical authentication bypass flaw. Security researchers have identified that unauthenticated attackers can access every API endpoint in the application without providing valid credentials. This vulnerability effectively grants remote adversaries full administrative privileges, enabling them to manipulate core HR data structures and extract sensitive personal information from the platform.

The National Vulnerability Database lists the issue as CVE-2026-108707 with a CVSS score of 9.3, classifying it as Critical. The flaw stems from improper handling of the AUTH-TOKEN header within the ParamAspect component. By simply omitting this required header during API requests, attackers can bypass all authentication checks. Consequently, they gain the ability to read payslips, view salary histories, download attached documents, and modify or delete company-wide HR records.

What we know

The vulnerability affects versions of Wukong_HRM developed by WuKongOpenSource up to commit 186115e1a5a0b827ad9596ff8c2f3a876fb0cc55. According to the NVD record, the weakness is categorised under CWE-287, which relates to improper authentication mechanisms. The specific technical trigger involves the ParamAspect module failing to enforce mandatory authentication when the AUTH-TOKEN header is absent from incoming requests.

Our data desk analysis of public CVE records shows that WuKongOpenSource was among the top vendors for high-severity issues in the last 24 hours. During this period, 237 new CVE records were published, including five rated Critical (CVSS 9.0+). CVE-2026-108707 was one of the highest-rated flaws, alongside issues in TOZED X300 and OpenSpug Spug. This indicates a concentrated period of high-risk disclosures across multiple software vendors.

Defender's checklist

• Verify if your organisation runs Wukong_HRM and check the current commit hash against the affected version 186115e1a5a0b827ad9596ff8c2f3a876fb0cc55.
• Review server logs for API requests that lack the AUTH-TOKEN header, as these may indicate exploitation attempts or successful breaches.
• Assess the exposure of HR API endpoints to the public internet, as unauthenticated access is possible without network-level restrictions.
• Confirm whether any sensitive employee data, such as payslips or personal details, has been accessed or modified recently.

What to do and how to stay safe: Wukong_HRM

• Restrict network access to HR management APIs so that only authorised internal systems can reach the endpoints, reducing the attack surface.
• Implement strict input validation and mandatory header checks at the web application firewall level to block requests missing required authentication tokens.
• Monitor for unusual data export activities or bulk deletions in HR records, which could signal that an attacker is exploiting the bypass.
• Once the vendor provides an update, apply the patch immediately to resolve the authentication failure in the ParamAspect component.

Step-by-step guide: Virtual Patching: Benefits, Limits and When to Use It

General security guidance from the TechWire Beat newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for the Wukong_HRM authentication bypass?

The vulnerability CVE-2026-108707 is rated CVSS 9.3, which is classified as Critical severity.

Which versions of Wukong_HRM are affected by this flaw?

The issue affects Wukong_HRM versions up to commit 186115e1a5a0b827ad9596ff8c2f3a876fb0cc55.

How do attackers exploit this vulnerability?

Attackers exploit the flaw by omitting the AUTH-TOKEN header in API requests, allowing them to bypass authentication and access all HRM endpoints.