Wukong_HRM: Missing authorization allows employee access to all HR data

Summary

Wukong_HRM through commit 186115e grants every authenticated caller the HR administrator role and returns all employees in data-scope checks. Any logged-in employee with a low-privilege account can read payslips, salary records, bank cards and personal data, change bank card data, and delete employees, departments and contracts company-wide. Exploitation requires only a valid login, and researcher proof-of-concept scripts are referenced in the CVE record.

Affected

• WuKongOpenSource Wukong_HRM through commit 186115e1a5a0b827ad9596ff8c2f3a876fb0cc55
• No release version numbers are published; the affected range is defined by commit hash only.

Fixed in

Unknown. No fixed version or vendor advisory was found.

Workaround

• No vendor-issued workaround known.
• Restrict access to the HRM instance to VPN or the internal network; do not expose it to the internet.

Exploitation

• Attack requires a valid low-privilege account (PR:L), no user interaction.
• Public proof-of-concept scripts are linked in the CVE record; sources conflict on public PoC status.
• CISA SSVC: exploitation status 'poc', automatable: no, technical impact: total.
• No evidence of exploitation in the wild found; not listed in KEV.

Our recommendation

• Verify whether Wukong_HRM is deployed at or before commit 186115e.
• Restrict network access to the HRM application and remove unnecessary employee logins.
• Monitor for a vendor fix and update as soon as one is available.
• Audit recent changes to bank card data, employee records, departments and contracts, and review application logs for unusual access.
• If unauthorised access is found, assess reporting duties under the Swiss revised FADP and GDPR where applicable, and involve legal counsel.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• VulnCheck advisory www.vulncheck.com
• Vulnerable code: EmployeeAspect.java github.com
• Vulnerable code: EmployeeUtil.java github.com
• PoC script: payroll, card and social security github.com
• PoC script: salary archives and history github.com
• VulDB entry vuldb.com
• Strix CVE entry www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:05.