ZKTeco BioTime CVE-2026-108797

Exploitation targets the Employee REST API endpoint /personnel/api/employees/ and requires a valid low-privilege authenticated session (CVSS PR:L) - it is NOT unauthenticated. The attacker then manipulates a user-controlled key/object reference to access records outside their authorization scope. Limiting factors: the attacker must first possess or obtain valid (even low-tier) BioTime credentials and the target must expose the BioTime web/REST API over a reachable network path; impact is confined to confidentiality of personnel data (no write/integrity or availability effect per VI:N/VA:N), so this does not by itself yield account takeover or system compromise.

This is a medium-severity authorization bypass (CWE-639, IDOR-class) in the ZKTeco BioTime Employee REST API, rated CVSS 4.0 base 5.3 with vector AV:N/AC:L/AT:N/PR:L/UI:N and only low confidentiality impact (VC:L) and no integrity or availability impact (VI:N/VA:N). The combined signals point to a modest, not urgent, priority: the network attack vector and low complexity make it easy to attempt, but PR:L means the attacker must already hold at least a low-privilege authenticated account, which meaningfully narrows the realistic attacker population to insiders or anyone who can obtain valid low-tier credentials. No EPSS score was provided in the input, the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis. The one notable amplifier is the vendor posture: VulDB states the vendor was contacted but did not respond, implying no patch is currently available, so the exposure is likely to persist. The scored impact is limited to confidentiality (reading/enumerating employee records the account should not access) rather than full account takeover, so despite easy remote reachability this is best treated as a data-exposure risk requiring prompt but not emergency remediation. Note the single-source nature (VulDB only, no NVD enrichment or vendor advisory) limits confidence in the precise impact scope.

A low-privileged authenticated user of a ZKTeco BioTime deployment (for example a standard employee or a compromised low-tier account) sends crafted requests to /personnel/api/employees/, manipulating an identifier or object reference to read employee records belonging to other users or departments they should not be able to access. No public exploit code is referenced, but the low attack complexity (AC:L) means the request manipulation is straightforward once a valid session exists.