Wukong_HRM Authentication and Authorization Bypass

Unauthenticated attackers can reach every Wukong_HRM API endpoint and operate with HR administrator privileges, because the platform's ParamAspect authorization component treats an absent AUTH-TOKEN header as an implicit pass instead of a denial. Exploitation requires nothing more than network reachability to the HRM API on a build at or before commit 186115e - no credentials, token, configuration change, or user interaction - and it exposes payslips, salary history, and employee personal data, permits attachment downloads, and allows modification or deletion of company-wide HR records. Publicly available exploit code exists (multiple proof-of-concept scripts published alongside the VulnCheck advisory), the CVSS 4.0 base score is 9.3, and no confirmed active exploitation (CISA KEV) has been reported; the risk is nevertheless genuine rather than CVSS-inflated, since the bypass is triggered by simply omitting a request header.

Missing authorization in Wukong HRM (all versions through commit 186115e) lets any authenticated employee, including the lowest-privileged role, read company-wide payslips, salary records, bank card details and personal data, edit bank cards, and delete employees, departments and contracts. The defect is structural: the HR administrator role is unconditionally assigned to every caller and data-scope checks return the entire employee set instead of the caller's permitted scope, so both horizontal and vertical privilege boundaries collapse for any valid session. Publicly available exploit code exists - two PoC scripts targeting salary archive history and payroll card/Social Security data - so anyone with valid low-privilege employee credentials and network reach to the HRM web application can exploit this reliably; no KEV listing or confirmed active exploitation is present in the available data.