CVE-2026-108796: ZKTeco BioTime Biometric Data Endpoint finger_data authorization
A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This affects an unknown part of the file /iclock/fingerdata/ of the component Biometric Data Endpoint. Executing a manipulation of the argument empcode can lead to authorization bypass. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attack can be launched remotely, but the CVSS vector indicates that the attacker needs low-level privileges. No user interaction is required.
What is the likely impact if exploitation succeeds?
The vulnerability can bypass authorization controls on the Biometric Data Endpoint by manipulating the emp_code argument. The stated impact is limited to confidentiality; integrity and availability impacts are not indicated.
Which deployments should be considered potentially affected?
ZKTeco BioTime 9.5.6 Build 20260130.3206 is identified as affected. The available information does not establish whether other versions, configurations, or default deployments are affected.
Is a vendor fix available?
No vendor response or fix is described. The vendor was contacted early about the disclosure but did not respond.