CVE-2026-108797
Received Received - Intake

Authorization Bypass in ZKTeco BioTime Employee REST API

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulDB

Description
A vulnerability has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This vulnerability affects unknown code of the file /personnel/api/employees/ of the component Employee REST API. The manipulation leads to authorization bypass. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-108797
EUVD
EUVD-2026-97168

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ZKTeco BioTime 9.5.6 Build 20260130.3206

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization bypass in ZKTeco BioTime 9.5.6 Build 20260130.3206. It affects the Employee REST API, specifically the /personnel/api/employees/ endpoint. The flaw allows remote attackers to bypass access controls and gain unauthorized access to sensitive employee data or system functions.

Detection Guidance

This vulnerability involves an authorization bypass in ZKTeco BioTime 9.5.6 Build 20260130.3206. Detection may involve checking for unauthorized access attempts to the /personnel/api/employees/ endpoint. Monitor network traffic for unusual requests to this path and verify access logs for anomalies. No specific commands are provided in the context.

Impact Analysis

If you use ZKTeco BioTime 9.5.6 Build 20260130.3206, attackers could remotely access employee records, manipulate personnel data, or perform unauthorized actions without proper authentication. This could lead to data breaches, privacy violations, or operational disruptions.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data without authorization and HIPAA by compromising protected health information if employee data includes such details. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Immediately restrict access to the /personnel/api/employees/ endpoint in ZKTeco BioTime 9.5.6 Build 20260130.3206. Update or patch the software if an official fix is released. Monitor network traffic for unauthorized access attempts to this API endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108797. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart