| Title | ZKTeco BioTime 9.5.6 Build 20260130.3206 Information Disclosure / Insecure Direct Object Reference |
|---|
| Description | An insecure direct object reference (IDOR) vulnerability in the biometric data endpoints of ZKTeco BioTime (ZKBioTime) 9.5.6 Build 20260130.3206 allows a low-privilege authenticated user to access biometric templates belonging to arbitrary employees by supplying another employee code.
The affected endpoints /iclock/finger_data/, /iclock/face_data/ and /iclock/palm_data/ accept an employee code through the emp_code parameter and return the corresponding stored biometric template without verifying whether the authenticated user is authorized to access that employee's biometric data.
During testing, a low-privilege authenticated BioTime account was sufficient to request biometric templates for employees other than the authenticated user's permitted records.
The affected endpoints include:
GET /iclock/finger_data/?emp_code=<employee_code>
GET /iclock/face_data/?emp_code=<employee_code>
GET /iclock/palm_data/?emp_code=<employee_code>
The returned data contains the stored biometric template in Base64-encoded proprietary ZKTeco format. Fingerprint templates observed during testing were approximately 1.2 KB per template.
The vulnerability occurs because the server uses the attacker-controlled emp_code value to retrieve the requested employee's biometric record without enforcing an object-level authorization check to determine whether the requesting account is permitted to access that employee's biometric data.
This allows an authenticated low-privilege user to change the emp_code value and retrieve biometric templates belonging to other employees.
Attack flow:
1. An attacker obtains or uses a low-privilege authenticated BioTime account.
2. The attacker sends a request to one of the biometric data endpoints.
3. The attacker supplies an employee code belonging to another employee through the emp_code parameter.
4. BioTime retrieves and returns the corresponding biometric template without performing an object-level authorization check.
5. The attacker can repeat the request with other employee codes to enumerate and collect biometric templates.
Impact:
Successful exploitation allows a low-privilege authenticated user to obtain biometric templates belonging to other employees, including fingerprint, face, and palm templates. This can result in large-scale exposure of highly sensitive biometric data across the workforce and compromise the confidentiality of biometric information stored by the BioTime installation.
The attack requires an authenticated BioTime account with low privileges. No victim interaction is required.
Affected components:
- /iclock/finger_data/
- /iclock/face_data/
- /iclock/palm_data/
- emp_code parameter
The issue was reported to ZKTeco through its security reporting channel. ZKTeco subsequently confirmed that its R&D team fixed this vulnerability. At the time of submission, the exact publicly released fixed version/build had not been provided.
CVSS v3.1: 7.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CWE:
- CWE-639: Authorization Bypass Through User-Controlled Key
- CWE-200: Exposure of Sensitive Information |
|---|
| User | bashdar (UID 101020) |
|---|
| Submission | 09/05/2026 11:01 (2 months ago) |
|---|
| Moderation | 10/11/2026 11:11 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 416573 [ZKTeco BioTime 9.5.6 Build 20260130.3206 Biometric Data Endpoint /iclock/finger_data/ emp_code authorization] |
|---|
| Points | 17 |
|---|