CVE-2026-108707 PoC?

Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header. Attackers gain HR administrator access to read payslips, salary history and employee personal data, download attachments, and modify or delete company-wide HR records.

This vulnerability allows an attacker from the Internet to bypass authentication. The product does not correctly verify the claimed identity, so the attacker can authenticate without valid credentials. A successful attack leads to a high loss of confidentiality, a high loss of integrity and a high loss of availability.

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Confidentiality Impact to the Vulnerable System

Integrity Impact to the Vulnerable System

Availability Impact to the Vulnerable System

Confidentiality Impact to the Subsequent System

Integrity Impact to the Subsequent System

Availability Impact to the Subsequent System

Temporal score updated on 19 Oct 2026, 03:11

Source: PatchCVE CVSS-BT — score adjusted with the official CVSS 4.0 algorithm (MacroVector) from the NVD base vector and the estimated Exploit Maturity (CISA KEV, exploit-db).

SSVC (CISA): Exploitation = PoC — public proof of concept observed

Temporal score updated on 19 Oct 2026, 03:11

SSVC (CISA): Exploitation = PoC — public proof of concept observed

CNA affected data: only versions up to 186115e1a5a0b827ad9596ff8c2f3a876fb0cc55 are affected — a fixed version exists above it