CVE-2026-108797: ZKTeco BioTime Employee REST API employees authorization
A vulnerability has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This vulnerability affects unknown code of the file /personnel/api/employees/ of the component Employee REST API. The manipulation leads to authorization bypass. The attack may be initiated remotely. Upgrading to version 9.5.6 Build 3623 is able to resolve this issue. The affected component should be upgraded.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ZKTeco BioTimeto a version that resolves this vulnerability.Fixed in 9.5.6 Build 3623
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of ZKTeco BioTime 9.5.6 Build 20260130.3206 that expose the Employee REST API endpoint at /personnel/api/employees/ are affected according to the available information. The attack can be initiated remotely.
What access does an attacker need?
The CVSS vector indicates that an attacker needs low-level privileges (PR:L) and does not require user interaction. Exploitation has low attack complexity and can be performed over the network.
What could an attacker gain through exploitation?
The reported impact is limited to confidentiality, rated low. No integrity or availability impact is indicated in the supplied CVSS vector.
Is a vendor fix available?
The available information does not identify a fix or mitigation. It states that the vendor was contacted early but did not respond.