CVE-2026-108797: ZKTeco BioTime Employee REST API employees authorization
A vulnerability has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This vulnerability affects unknown code of the file /personnel/api/employees/ of the component Employee REST API. The manipulation leads to authorization bypass. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of ZKTeco BioTime 9.5.6 Build 20260130.3206 that expose the Employee REST API endpoint at /personnel/api/employees/ are affected according to the available information. The attack can be initiated remotely.
What access does an attacker need?
The CVSS vector indicates that an attacker needs low-level privileges (PR:L) and does not require user interaction. Exploitation has low attack complexity and can be performed over the network.
What could an attacker gain through exploitation?
The reported impact is limited to confidentiality, rated low. No integrity or availability impact is indicated in the supplied CVSS vector.
Is a vendor fix available?
The available information does not identify a fix or mitigation. It states that the vendor was contacted early but did not respond.