Key points
- CVE-2026-108707 allows unauthenticated access to all HRM API endpoints by omitting the AUTH-TOKEN header.
- The vulnerability is rated CVSS 9.3 Critical and affects Wukong_HRM versions up to commit 186115e.
- Attackers can read payslips, modify records, and delete company-wide data without logging in.
By the numbers
- CVSS 9.3: The severity score assigned to CVE-2026-108707, placing it in the Critical range.
- 237: The total number of new CVE records published in a single 24-hour period.
- 5: The count of new vulnerabilities rated 9.0 or higher in that same daily batch.
What the figures mean
Wukong_HRM contains a severe authentication bypass flaw identified as CVE-2026-108707. According to the National Vulnerability Database, this issue exists in versions of the software up to commit 186115e1a5a0b827ad9596ff8c2f3a876fb0cc55. The vulnerability resides in a component called ParamAspect. An attacker does not need valid credentials to exploit it. Instead, they simply omit the AUTH-TOKEN header when making requests. This omission tricks the system into granting full administrative access.
The consequence is immediate and total. Unauthenticated attackers can call every API endpoint in the HRM system. They gain the ability to read sensitive employee information, including payslips and salary history. They can also download attachments stored within the platform. Beyond reading data, the flaw allows attackers to modify or delete company-wide human resources records. This effectively gives an outsider complete control over the organization’s personnel data without ever logging in.
This flaw emerged during a period of high vulnerability volume. Our data desk analysis of public records shows 237 new CVEs were published in one day. Among those, five were rated 9.0 or higher. Wukong_HRM’s CVE-2026-108707 was one of those five critical entries. Other high-severity issues in that batch affected vendors such as TOZED, OpenSpug, and SciSharp. WuKongOpenSource had two high-severity entries in that daily count.
What to watch
Security teams should monitor their networks for unusual API traffic to HR systems. Look for requests that lack standard authentication headers but still receive successful responses. This pattern indicates the ParamAspect flaw may be present. Also, watch for unauthorized changes to employee records or mass downloads of personnel files. These actions suggest an attacker is actively exploiting the unauthenticated access.
What to do and how to stay safe: Wukong_HRM
- Audit server logs for API requests to Wukong_HRM that do not include an AUTH-TOKEN header.
- Restrict network access to HR management systems so they are not reachable from the public internet.
- Implement strict input validation on all API endpoints to ensure required authentication parameters are present.
- Once the vendor provides an update, apply the patch immediately to versions prior to commit 186115e.
Step-by-step guide: Patch Management Implementation: A Step-by-Step Rollout Plan
General security guidance from the Sandbox Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-108707?
It is a critical authentication bypass vulnerability in Wukong_HRM that allows unauthenticated access to all API endpoints.
How do attackers exploit this flaw?
Attackers exploit it by omitting the AUTH-TOKEN header in their requests, which grants them full administrator privileges.
Which versions of Wukong_HRM are affected?
The vulnerability affects Wukong_HRM versions up to and including commit 186115e1a5a0b827ad9596ff8c2f3a876fb0cc55.
