Wukong HRM CVE-2026-108707

No special conditions beyond network reachability - remote unauthenticated exploitation works against affected Wukong_HRM builds (through commit 186115e) because the ParamAspect authorization aspect treats a missing AUTH-TOKEN header as a bypass rather than a rejection, so no credentials, token, configuration change, or user interaction is required. The only real limiting factors are that the target HRM API must be network-reachable to the attacker (e.g. internet-exposed or attacker on the internal network) and the instance must be running code at or before the vulnerable commit; there is no authentication, privilege, or default-configuration barrier to overcome.

This is a genuine high-priority issue, not a CVSS-inflated paper risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, 9.3) describes a fully remote, low-complexity, unauthenticated attack with high impact across confidentiality, integrity and availability, and the description corroborates the vector exactly: an attacker simply omits the AUTH-TOKEN header to bypass the ParamAspect authentication check and reach every HRM API endpoint. All signals align rather than conflict - the attack-vector claim (network, no privileges, no user interaction) is directly supported by the mechanism described, and three working proof-of-concept scripts (salary-slip read, employee PII export, attachment IDOR download) published by the VulnCheck-associated reporter confirm practical exploitability. Exploitation status: publicly available exploit code exists. No EPSS score was provided in the input, and this CVE is NOT listed in CISA KEV, so there is no evidence of confirmed active exploitation in the wild yet; the realistic concern is that trivial exploitation plus public POCs make opportunistic scanning likely. The main factor tempering absolute risk is deployment footprint (see prevalence), not exploit difficulty.

A remote attacker discovers an internet-exposed Wukong_HRM instance and sends HRM API requests with the AUTH-TOKEN header removed, causing ParamAspect to skip authentication entirely. They then invoke administrative endpoints to read payslips and salary history, export the full employee PII dataset, and download attachments via IDOR, and can further modify or delete company-wide HR records. Public POC scripts for salary-slip read, PII export, and attachment download already automate this.