ZKTeco BioTime CVE-2026-108796

Exploitation requires an authenticated low-privilege session on ZKTeco BioTime (CVSS PR:L), after which the attacker directly manipulates the emp_code argument on the /iclock/finger_data/ Biometric Data Endpoint to reference other employees' records. The limiting factors are: a valid account is mandatory (not unauthenticated), impact is confined to read access of biometric data (VC:L, no integrity or availability effect), and exposure depends on the BioTime web interface being network-reachable to the attacker. The specific affected build is 9.5.6 Build 20260130.3206.

This is a genuine but moderate-severity issue rather than an urgent priority. The sole input CVSS is a 4.0 vector (base 5.3) with AV:N/AC:L/PR:L/UI:N/VC:L and no integrity or availability impact, indicating a network-reachable but authenticated (PR:L) read-only authorization bypass - an insecure direct object reference consistent with CWE-639. No EPSS score, CISA KEV listing, or public POC was provided, so exploitation probability signals are entirely absent; per the precision rules this means no public exploit is identified at time of analysis. The only signal in favor of attention is that the flaw is network-exploitable with low complexity and only requires a low-privilege account. Signals conflict mildly in interpretation: VC:L caps real-world confidentiality harm as limited per-request, yet the impacted data is employee biometric/fingerprint records, which raises privacy stakes beyond what a 'Low' confidentiality rating suggests. The vendor was contacted and did not respond, so no patch is confirmed, which modestly increases exposure window. Overall: a real, low-complexity authenticated IDOR worth remediating, but not a drop-everything priority absent any exploitation evidence.

An attacker holding any valid low-privilege BioTime account (PR:L) sends requests to /iclock/finger_data/ while tampering with the emp_code parameter to reference other employees' identifiers, retrieving biometric/fingerprint data belonging to accounts they should not access. No public exploit code was identified, and the attack is remote and low-complexity but requires prior authentication.