Wukong HRM CVE-2026-108708

Exploitation requires a valid authenticated session as any employee, even the lowest-privileged role - the flaw is that EmployeeAspect unconditionally assigns the HR administrator role to every caller and EmployeeUtil data-scope checks return the full employee set rather than the caller's permitted scope. The only limiting factor is that the attacker must possess (or obtain) working low-privilege employee credentials and reach the HRM web application over the network; no special non-default configuration, user interaction, or elevated privileges are needed, and exploitation works against the standard deployment of Wukong HRM at commit 186115e. There is no additional feature toggle or deployment mode required - the authorization gap is present in the default application logic.

This is a genuine priority within its (limited) deployment footprint, though signals are mixed on breadth of exploitation. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring only a low-privileged authenticated employee account, with high confidentiality, integrity and availability impact to the vulnerable system (VC:H/VI:H/VA:H), yielding the 8.7 High score - and this is fully consistent with the description (any authenticated low-privileged employee gains effective HR-admin capability). Publicly available exploit code exists (two VulnCheck-linked POC scripts targeting salary archives and payroll/social-security card data), which materially raises the practical likelihood of opportunistic abuse by insiders or anyone who obtains a single valid employee credential. However, this is NOT in CISA KEV and no EPSS score was provided in the input, so there is no evidence of widespread active exploitation - the combination of a niche open-source product plus a working POC points toward targeted/insider abuse rather than internet-scale mass exploitation. No conflicting signals were detected between the CVSS vector and the description; both agree on authenticated (PR:L) network access. The main caveat is product reach: a critical-grade broken-access-control flaw in software with a small real-world footprint is still constrained by how few organizations run it.

A disgruntled or compromised low-privileged employee logs into the Wukong HRM web application with their normal credentials; because EmployeeAspect grants every caller the HR-administrator role and EmployeeUtil data-scope checks return all employees, they query payroll and salary endpoints to exfiltrate company-wide payslips, bank cards and personal data. Public POC scripts (poc_salary_archives_history.py and poc_payroll_card_social_security.py) demonstrate the salary/payroll data theft, and the same authorization gap lets the attacker edit bank card details or delete employees, departments and contracts across the organization.