CVE-2026-108708: Wukongopensource Wukong Hrm

High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days.

Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil data-scope checks return all employees. Any authenticated low-privileged employee can read payslips, salary records, bank cards and personal data, edit bank cards, and delete employees, departments and contracts company-wide.

Affected products

• Wukongopensource Wukong Hrm

Published 2026-10-11. Last modified 2026-10-16.