ZKTeco BioTime Biometric Data Endpoint finger_data authorization
A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This affects an unknown part of the file /iclock/finger_data/ of the component Biometric Data Endpoint. Executing a manipulation of the argument emp_code can lead to authorization bypass. The attack can be launched remotely. Upgrading to version 9.5.6 Build 3623 is able to mitigate this issue. You should upgrade the affected component.
CVE-2026-108796
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-108796
BioTime
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"cpes": [
"cpe:2.3:a:zkteco:biotime:*:*:*:*:*:*:*:*"
],
"vendor": "ZKTeco",
"modules": [
"Biometric Data Endpoint"
],
"product": "BioTime",
"versions": [
{
"status": "affected",
"version": "9.5.6 Build 20260130.3206"
},
{
"status": "unaffected",
"version": "9.5.6 Build 3623"
}
]
}
]- Related CVEs
- CVE-2026-108796
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #32421 · Revision 1
- Added to Heist Feed
- Publisher date