Description
A vulnerability has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This vulnerability affects unknown code of the file /personnel/api/employees/ of the component Employee REST API. The manipulation leads to authorization bypass. The attack may be initiated remotely. Upgrading to version 9.5.6 Build 3623 is able to resolve this issue. The affected component should be upgraded.
Published: 2026-10-12
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Authorization Bypass
Action: Apply Patch
AI Analysis

Impact

A flaw in ZKTeco BioTime 9.5.6 Build 20260130.3206 allows an attacker to manipulate requests to the /personnel/api/employees/ endpoint in the Employee REST API, bypassing the intended authorization checks and accessing employee information without valid privileges. This issue is classified as an improper authorization weakness (CWE‑285) and an authorization bypass via user‑controlled key (CWE‑639). The vulnerability can be triggered remotely by sending crafted requests to the affected component, enabling an adversary to read or modify employee data that should be protected by authentication and role‑based access control.

Affected Systems

The affected system is ZKTeco BioTime 9.5.6 Build 20260130.3206. The vulnerability resides in the Employee REST API component, specifically the /personnel/api/employees/ endpoint. No other versions or products have been confirmed as vulnerable according to the available data.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity. The EPSS score of 0.00218 (about 0.2%) shows a very low but non‑zero probability of exploitation. The vulnerability is remote and not listed in CISA's KEV catalog. An available patch—upgrading to version 9.5.6 Build 3623—remediates the issue; however, until organizations apply the update, the risk of unauthorized access to employee data remains.

Generated by OpenCVE AI on October 17, 2026 at 08:48 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest vendor patch for BioTime that addresses the authorization bypass in the Employee REST API.
  • Restrict external access to the /personnel/api/employees/ endpoint, allowing only trusted IP ranges or requiring additional authentication.
  • Enable detailed logging for the Employee REST API and regularly review logs for suspicious activity, such as unexpected read or write operations to employee data.

Generated by OpenCVE AI on October 17, 2026 at 08:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 16 Oct 2026 13:00:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This vulnerability affects unknown code of the file /personnel/api/employees/ of the component Employee REST API. The manipulation leads to authorization bypass. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way. A vulnerability has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This vulnerability affects unknown code of the file /personnel/api/employees/ of the component Employee REST API. The manipulation leads to authorization bypass. The attack may be initiated remotely. Upgrading to version 9.5.6 Build 3623 is able to resolve this issue. The affected component should be upgraded.
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:P/I:N/A:N/E:ND/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R'}

 cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:P/I:N/A:N/E:ND/RL:OF/RC:C'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C'}

Tue, 13 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 12 Oct 2026 04:15:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This vulnerability affects unknown code of the file /personnel/api/employees/ of the component Employee REST API. The manipulation leads to authorization bypass. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Title ZKTeco BioTime Employee REST API employees authorization
First Time appeared Zkteco
Zkteco biotime
Weaknesses CWE-285
CWE-639
CPEs cpe:2.3:a:zkteco:biotime:*:*:*:*:*:*:*:*
Vendors & Products Zkteco
Zkteco biotime
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:P/I:N/A:N/E:ND/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X'}

Subscriptions

Zkteco Biotime
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-16T12:45:50.379Z

Reserved: 2026-10-11T09:11:22.572Z

Link: CVE-2026-108797

cve-icon Vulnrichment

Updated: 2026-10-13T19:09:41.883Z

cve-icon NVD

Status : Deferred

Published: 2026-10-12T04:16:48.563

Modified: 2026-10-16T13:16:54.620

Link: CVE-2026-108797

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T09:00:08Z

Weaknesses
  • CWE-285

    Improper Authorization

  • CWE-639

    Authorization Bypass Through User-Controlled Key