CVE-2026-108707: Wukong_HRM Bypass

Are You Affected?

CVE-2026-108707 affects Wukong_HRM, an open-source human-resources management application. The NVD description identifies all revisions through commit 186115e as affected. The record does not provide a conventional semantic-version range such as 1.2.0 through 1.4.3; the affected boundary is expressed as a Git revision.

Treat a deployment as potentially affected if its source tree, container image, or build artifact corresponds to commit 186115e or an earlier revision. A later commit alone does not establish that the deployment is safe. The available record does not identify a remediation commit, so defenders must inspect upstream changes affecting authentication enforcement.

The impact is particularly serious for organizations using Wukong_HRM for payroll, employee records, or document storage. A successful attacker may be able to read payslips, salary history, employee personal information, and attachments. The description also reports the ability to modify or delete company-wide HR records, creating both privacy and operational risk.

The Fix, If You’re in a Hurry

There is no confirmed fixed version to which organizations can upgrade. The supplied NVD data identifies the vulnerable boundary but does not identify a vendor advisory, patched release, or remediation commit. Do not assume that upgrading to an arbitrary later build resolves the issue.

First, identify the deployed revision and isolate the service from the public internet. For a source checkout, use:

git rev-parse HEAD
git log --oneline --decorate -n 10
git fetch --tags origin

Compare the resulting commit with 186115e. If the project publishes a verified fixed commit or release, update only after reviewing the authentication-related diff:

git fetch origin
git checkout <verified-fixed-commit>
git rev-parse HEAD

The placeholder must be replaced with a commit confirmed by the project or by an independently reviewed patch. Until that information is available, use a compensating control at the reverse proxy or network layer. For example, an Nginx deployment can restrict the application to a VPN or trusted administration network:

location / {
    allow 10.20.0.0/16;
    allow 192.0.2.0/24;
    deny all;

    proxy_pass http://wukong_hrm_backend;
}

Replace the example networks with approved administrative ranges. This is not a code-level fix, but it prevents unauthenticated internet clients from reaching the vulnerable API. If the application must remain reachable externally, place it behind an authenticated gateway and block direct access to the backend.

After containment, rotate application credentials, session secrets, and API tokens if logs indicate unauthorized access. Preserve relevant logs before restarting or rebuilding the service. Organizations reviewing broader endpoint visibility can also consult this malware glossary when standardizing incident-response terminology. Where additional endpoint monitoring is needed, Get Bitdefender → may be considered as one option alongside the organization’s existing security controls.

Analyst’s Take: The immediate priority is exposure reduction, not an arbitrary upgrade, because no fixed version or remediation commit has been identified. Restricting access and reviewing logs address the two urgent questions: whether the vulnerable API is reachable and whether it has already been used.

How This Vulnerability Works

The vulnerability is an authentication-enforcement failure in the ParamAspect request-processing component. According to the NVD description, an attacker can send requests to HRM API endpoints without an AUTH-TOKEN header and still reach functionality intended for authenticated HR administrators.

The apparent attack sequence is straightforward:

1. Discover or request an HRM API endpoint.
2. Send the request without the expected AUTH-TOKEN header.
3. Bypass the authentication check implemented by the request-processing path.
4. Invoke endpoints that expose or modify HR data.

The related EmployeeAspect.java code is also identified in the NVD references, indicating that employee-scoped request handling may be part of the affected authorization path. The available material does not establish that every endpoint has identical behavior, nor does it provide a complete patch diff. Defenders should therefore assume broad API exposure until endpoint-level testing proves otherwise.

The resulting access is more than a simple information disclosure. The reported impact includes employee PII export, salary-slip retrieval, attachment downloads, and modification or deletion of HR records. Any incident response investigation should cover confidentiality, integrity, and availability, rather than looking only for read operations.

Technical Notes

The referenced source locations are:

common/common-web/src/main/java/com/kakarote/core/config/ParamAspect.java
hrm/hrm-web/src/main/java/com/kakarote/hrm/common/EmployeeAspect.java

The affected source reference points to commit:

186115e1a5a0b827ad9596ff8c2f3a876fb0cc55

That full hash is useful when comparing a source checkout or software bill of materials. It should not be interpreted as a fixed commit; it is the vulnerable code reference supplied by the NVD materials.

Severity, Explained

CVE-2026-108707 carries a CVSS base score of 9.8, classified as Critical. The exact CVSS vector was not included in the supplied NVD response and should be confirmed against the live canonical NVD record before publication in an internal advisory or compliance report.

The score is consistent with a vulnerability that is remotely reachable, requires no credentials, and can affect confidentiality, integrity, and availability. An attacker does not need an existing HR account if omitting AUTH-TOKEN is sufficient to bypass the expected check. The potential impact is high because the application handles payroll data, employee personal information, attachments, and company-wide HR records.

The score does not predict whether a particular organization has been compromised. It also does not account for controls such as VPN-only access, gateway authentication, network segmentation, monitoring, or limited data exposure. Organizations with internet-facing instances should treat this as an emergency exposure-reduction issue because public exploit references lower the barrier to attack.

Is It Being Exploited?

Public proof-of-concept references are present in the NVD record. The referenced material covers attachment download or IDOR behavior, employee PII export, and salary-slip detail retrieval. The first two referenced GitHub URLs returned HTTP 503 Service Unavailable during collection, so their contents could not be independently reviewed in that collection run.

Active exploitation in the wild is not confirmed by the supplied evidence. CVE-2026-108707 is not listed in the CISA Known Exploited Vulnerabilities catalog based on the lookup provided. There is therefore no CISA confirmation of exploitation, ransomware use, or a required remediation deadline.

Public PoC availability is still operationally important. Attackers can use the vulnerability description and public references to test whether an exposed installation accepts requests without AUTH-TOKEN. Treat internet-facing systems as high priority even in the absence of confirmed exploitation. Investigate historical access before applying containment because the vulnerable behavior may leave no application-level authentication failure.