Reported by 2 outlets
CVE-2026-108707: WuKong_HRM critical auth bypass
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.00 / 2.0 · best outlet weight
- Severity
- 1.00 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.24 / 0.6 · time to second source
- Recency
- × 0.24 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.8 / 10 = base × recency + community
Analysis
WuKong_HRM (commit 186115e and earlier) has a critical authentication bypass: omitting the AUTH-TOKEN header grants full HR admin access without any authentication. CVE-2026-108707 scores 9.8. A second flaw, CVE-2026-108708 (8.8), allows any authenticated employee to escalate. Both are in the open-source HR management system. No patch timeline is stated in the events; users of the platform should treat this as actively exploitable because the bypass requires zero credentials. Watch for a vendor fix and for any evidence of in-the-wild scanning against exposed HR endpoints.
Timeline
-
original reporting
CRITICAL: CVE-2026-108707 in WuKong_HRM (≤ commit 186115e) enables auth bypass — attackers can access all HRM APIs, gaining admin rights and
radar.offseq.com · 3d ago · October 11th, 2026
CRITICAL: CVE-2026-108707 in WuKong_HRM (≤ commit 186115e) enables auth bypass — attackers can access all HRM APIs, gaining admin rights and
via Mastodon https://radar.offseq.com/threat/cve-2026-108707-improper-authentication-in-wukongopensource-wukonghrm-13cec42117273b1c
-
update from threataft.com
CVE-2026-108707 + CVE-2026-108708 — Wukong_HRM 9.8: omit AUTH-TOKEN header → full HR admin. No auth needed. 8.8: any authenticated employee
threataft.com · 2d ago · October 12th, 2026
CVE-2026-108707 + CVE-2026-108708 — Wukong_HRM 9.8: omit AUTH-TOKEN header → full HR admin. No auth needed. 8.8: any authenticated employee
via Mastodon https://threataft.com/articles/wukong-hrm-authentication-bypass-cve-2026-108707