CVE-2026-108796
4.3MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-285, CWE-639
Impact
Authenticated remote attackers can bypass authorization controls to access other users' biometric data. They only need low-privilege network access to the application endpoint.
Root cause
Improper authorization checks (IDOR) allow users to tamper with the emp_code parameter in the /iclock/finger_data/ endpoint.
Affected systems
ZKTeco BioTime 9.5.6 Build 20260130.3206
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Fix & remediation
Upgrade ZKTeco BioTime to 9.5.6 Build 3623 or later. If patching immediately is not possible, restrict network access to the /iclock/finger_data/ endpoint at the reverse proxy or firewall.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This affects an unknown part of the file /iclock/finger_data/ of the component Biometric Data Endpoint. Executing a manipulation of the argument emp_code can lead to authorization bypass. The attack can be launched remotely. Upgrading to version 9.5.6 Build 3623 is able to mitigate this issue. You should upgrade the affected component.