Wukong_HRM vulnerabilities

2 known vulnerabilities in Wukong_HRM from WuKongOpenSource. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  Wukong_HRM: Missing Authorization

  CVE-2026-108708Oct 11, 2026WuKongOpenSource

  Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil data-scope checks return all employees. Any authenticated low-privileged employee can read p

• 9.8 Critical severity

  Wukong_HRM: Improper Authentication

  CVE-2026-108707Oct 11, 2026WuKongOpenSource

  Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header. Attackers gain HR administrator access to read payslips, sa