CVE-2026-108797
4.3MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-285, CWE-639
Impact
Authenticated remote users can bypass authorization controls to access restricted employee records via the REST API. An attacker only needs low-privileged network access to the BioTime application.
Root cause
An insecure direct object reference or missing authorization check in the /personnel/api/employees/ endpoint fails to enforce access boundaries.
Affected systems
ZKTeco BioTime 9.5.6 Build 20260130.3206
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Fix & remediation
Upgrade ZKTeco BioTime to version 9.5.6 Build 3623. If updating immediately is not possible, restrict access to the /personnel/api/employees/ path at the reverse proxy or WAF for non-admin sessions.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A vulnerability has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This vulnerability affects unknown code of the file /personnel/api/employees/ of the component Employee REST API. The manipulation leads to authorization bypass. The attack may be initiated remotely. Upgrading to version 9.5.6 Build 3623 is able to resolve this issue. The affected component should be upgraded.