Read the docs
TI-2026-70834 Aliases CVE-2026-108797GHSA-6674-3863-x8fv

Authorization bypass in ZKTeco BioTime Employee REST API

Priority MEDIUM 57CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-285.

Summary

ZKTeco BioTime from 9.5.6 Build 20260130.3206 contains an authorization bypass in the Employee REST API endpoint /personnel/api/employees/. The flaw is improper authorization (CWE-285), which lets a remote attacker with low privileges get around access controls. The impact on confidentiality is low and the CVSS vector reports no integrity or availability impact.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

A vulnerability has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This vulnerability affects unknown code of the file /personnel/api/employees/ of the component Employee REST API. The manipulation leads to authorization bypass. The attack may be initiated remotely. Upgrading to version 9.5.6 Build 3623 is able to resolve this issue. The affected component should be upgraded.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00274 19th percentileScored 2026-11-07
Fix Fixed BioTime (ZKTeco): 9.5.6 Build 3623

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ZKTecoBioTime9.5.6 Build 20260130.32069.5.6 Build 3623Patch availableCNA
  • BioTime VendorZKTeco Affected 9.5.6 Build 20260130.3206 Fixed in 9.5.6 Build 3623 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:zkteco:biotime:*:*:*:*:*:*:*:*——ZKTeco
  • cpe:2.3:a:zkteco:biotime:*:*:*:*:*:*:*:* Versions — — ·ZKTeco

Remediation

Upgrade ZKTeco BioTime to 9.5.6 Build 3623, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA BioTime (ZKTeco) Fixed in 9.5.6 Build 3623

Timeline

  1. 2026-10-12 Threatist record created from CVE-2026-108797
  2. 2026-10-12 Alias added: GHSA-6674-3863-x8fv
  3. 2026-10-13 CISA SSVC decision points changed
  4. 2026-10-13 Priority changed: LOW → MEDIUM
  5. 2026-10-16 CVSS score changed · CNA
  6. 2026-10-16 Fix available: ZKTeco/[email protected] Build 3623 · CNA
  7. 2026-10-16 1 new reference · CNA

References

Patch 1

  • TI-2023-20210 A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows… KEVCVSS 3.1HIGH 7.5
  • TI-2025-28829 Hard-coded credentials in ZKTeco ZKBio CVSecurity CVSS 3.1CRITICAL 9.8
  • TI-2024-24297 ZKTeco ZKBio CVSecurity v6.1.1 was discovered to contain a hardcoded cryptographic key. CVSS 3.1CRITICAL 9.8
  • TI-2023-20211 ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authenticated… CVSS 3.1CRITICAL 9.8
  • TI-2016-09202 ZKTeco ZKBioSecurity 3.0 Hardcoded Credentials Remote Code Execution CVSS 4.0CRITICAL 9.3
  • TI-2016-09200 ZKTeco ZKTime.Net 3.0.1.6 Insecure File Permissions Privilege Escalation CVSS 4.0CRITICAL 9.3
See all 70 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences