Wukong_HRM: Authentication bypass via ParamAspect in HRM API
Summary
Wukong_HRM through commit 186115e contains an authentication bypass in the ParamAspect component. An unauthenticated attacker can call HRM API endpoints by omitting the AUTH-TOKEN header. Successful exploitation gives HR administrator-level access to payslips, salary history, employee personal data and attachments, and allows modification or deletion of HR records. The attack requires only network access to the application.
Affected
- Wukong_HRM through commit 186115e1a5a0b827ad9596ff8c2f3a876fb0cc55
- Versions are defined by git commit; any release containing this commit is affected
Fixed in
Unknown.
Workaround
- Remove direct internet exposure of the HRM instance; place it behind a VPN or an SSO-enforcing reverse proxy that rejects requests without a valid session token
- Review logs for API calls without an AUTH-TOKEN header and for unexpected attachment downloads or exports
Exploitation
- Public proof-of-concept code exists (CISA SSVC: exploitation 'poc', automatable 'yes', technical impact 'total')
- Not known to be exploited in the wild; not listed in KEV
- One aggregator reports no public PoC; the CISA ADP data is weighted more heavily
Our recommendation
- Check whether any client runs Wukong_HRM and whether it is reachable from the internet
- Remove public exposure immediately or restrict access to VPN or an authenticating proxy
- Review logs for requests without an AUTH-TOKEN header and for unusual downloads or exports
- If exposure is suspected, treat employee data as compromised, rotate application credentials, review HR admin accounts and assess notification duties under the revised Swiss FADP
- Monitor the vendor repository and advisories for a fix and apply it when available
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- ParamAspect.java (vendor, commit 186115e) github.com
- EmployeeAspect.java (vendor, commit 186115e) github.com
- CVE record (CVEProject cvelistV5) raw.githubusercontent.com
- OpenCVE entry app.opencve.io
- Proof-of-concept repository (unreviewed) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:33.
Original description (NVD)
Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header. Attackers gain HR administrator access to read payslips, salary history and employee personal data, download attachments, and modify or delete company-wide HR records.
NVD references (6)
- https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/Wukong_HRM/poc_at…
- https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/Wukong_HRM/poc_em…
- https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/Wukong_HRM/poc_sa…
- https://github.com/WuKongOpenSource/Wukong_HRM/blob/186115e1a5a0b827ad9596ff8c2f3a876fb0cc55/common/common-we…
- https://github.com/WuKongOpenSource/Wukong_HRM/blob/186115e1a5a0b827ad9596ff8c2f3a876fb0cc55/hrm/hrm-web/src/…
- https://www.vulncheck.com/advisories/wukong-hrm-through-commit-186115e-authentication-bypass-via-paramaspect
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.