A flaw in ZKTeco BioTime 9.5.6 Build 20260130.3206 allows an attacker to manipulate requests to the /personnel/api/employees/ endpoint in the Employee REST API, bypassing the intended authorization checks and accessing employee information without valid privileges. This issue is classified as an improper authorization weakness (CWE‑285) and an authorization bypass via user‑controlled key (CWE‑639). The vulnerability can be triggered remotely by sending crafted requests to the affected component, enabling an adversary to read or modify employee data that should be protected by authentication and role‑based access control.

The affected system is ZKTeco BioTime 9.5.6 Build 20260130.3206. The vulnerability resides in the Employee REST API component, specifically the /personnel/api/employees/ endpoint. No other versions or products have been confirmed as vulnerable according to the available data.

The CVSS score of 5.3 indicates a moderate severity level, and while the EPSS score is not available, the remote nature of the attack suggests that exploitation is feasible under the right conditions. The vulnerability is not listed in CISA’s KEV catalog. Because the vendor has not released a patch or responded to early disclosures, the risk persists, and organizations should assume the capability to bypass authorization may be available to adversaries with network access to the REST API.