CVE-2026-108797

Deferred Deferred - Pending Action

Authorization Bypass in ZKTeco BioTime Employee REST API

Publication date: 2026-10-12

Last updated on: 2026-10-16

Assigner: VulDB

Description

A vulnerability has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This vulnerability affects unknown code of the file /personnel/api/employees/ of the component Employee REST API. The manipulation leads to authorization bypass. The attack may be initiated remotely. Upgrading to version 9.5.6 Build 3623 is able to resolve this issue. The affected component should be upgraded.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-12

EPSS Evaluated

2026-10-18

NVD

CVE-2026-108797

EUVD

EUVD-2026-97168

Affected Vendors & Products

Vendor	Product	Version / Range
ZKTeco	BioTime	9.5.6 Build 20260130.3206

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability is an authorization bypass in ZKTeco BioTime 9.5.6 Build 20260130.3206. It affects the Employee REST API, specifically the /personnel/api/employees/ endpoint. The flaw allows remote attackers to bypass access controls and gain unauthorized access to sensitive employee data or system functions.

Detection Guidance

This vulnerability involves an authorization bypass in ZKTeco BioTime 9.5.6 Build 20260130.3206. Detection may involve checking for unauthorized access attempts to the /personnel/api/employees/ endpoint. Monitor network traffic for unusual requests to this path and verify access logs for anomalies. No specific commands are provided in the context.

Impact Analysis

If you use ZKTeco BioTime 9.5.6 Build 20260130.3206, attackers could remotely access employee records, manipulate personnel data, or perform unauthorized actions without proper authentication. This could lead to data breaches, privacy violations, or operational disruptions.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data without authorization and HIPAA by compromising protected health information if employee data includes such details. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Immediately restrict access to the /personnel/api/employees/ endpoint in ZKTeco BioTime 9.5.6 Build 20260130.3206. Update or patch the software if an official fix is released. Monitor network traffic for unauthorized access attempts to this API endpoint.

Hi! I’m here to help you understand CVE-2026-108797. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70