| Title | ZKTeco BioTime 9.5.6 Build 20260130.3206 Information Disclosure / Insecure Direct Object Reference |
|---|
| Description | An insecure direct object reference (IDOR) and broken access control vulnerability in the employee API of ZKTeco BioTime (ZKBioTime) 9.5.6 Build 20260130.3206 allows a low-privilege authenticated user to access sensitive employee information belonging to other employees.
The affected endpoint /personnel/api/employees/ returns sensitive employee fields without enforcing adequate object-level authorization or restricting the response to information that the requesting low-privilege account is authorized to access.
During testing, a low-privilege authenticated BioTime account was sufficient to access the employee API and enumerate employee records. The response included sensitive fields such as access-card numbers, device passwords, gender, email address, mobile number, and biometric template version information.
The affected endpoint includes:
GET /personnel/api/employees/
Individual employee records can also be accessed through the corresponding object endpoint:
GET /personnel/api/employees/<id>/
The plural employees API exposes a broader serializer containing sensitive fields including card_no and device_password. In contrast, the corresponding singular employee API uses a reduced serializer that does not expose card_no, demonstrating that the sensitive fields are unnecessarily exposed by the plural API.
The equivalent employee HTML page is protected by access controls, but the API endpoint does not enforce equivalent authorization restrictions.
An attacker can therefore use a valid low-privilege authenticated account to enumerate employee records and obtain sensitive information belonging to employees outside the attacker's authorized scope.
Attack flow:
1. An attacker obtains or uses a low-privilege authenticated BioTime account.
2. The attacker sends an authenticated request to /personnel/api/employees/.
3. BioTime returns employee records containing sensitive fields that should be restricted.
4. The attacker enumerates employee records and obtains information belonging to other employees.
5. The attacker can request individual employee records through the corresponding object endpoint where applicable.
Example request:
GET /personnel/api/employees/
The response contains sensitive employee information including card_no, device_password, gender, email, mobile, and biometric template version information.
Impact:
Successful exploitation allows a low-privilege authenticated user to enumerate and obtain sensitive personal and access-control information for employees outside the user's authorized scope. Exposure of access-card numbers may facilitate unauthorized duplication or misuse of employee access credentials, while disclosure of personal information increases the risk of privacy violations and further attacks.
The attack requires an authenticated BioTime account with low privileges. No victim interaction is required.
Affected component:
- Employee REST API
- /personnel/api/employees/
- /personnel/api/employees/<id>/
- Employee object authorization and response serialization
Recommended remediation:
- Enforce object-level authorization for employee records.
- Apply the same authorization restrictions to the API that are applied to the protected HTML employee interface.
- Remove card_no, device_password, and other sensitive fields from responses available to low-privilege users.
- Use a restricted serializer for low-privilege API consumers.
- Prevent enumeration of employee records outside the requesting user's authorized scope.
The issue was reported to ZKTeco through its security reporting channel. ZKTeco subsequently confirmed that its R&D team fixed this vulnerability. At the time of submission, the exact publicly released fixed version/build had not been provided.
CVSS v3.1: 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CWE:
- CWE-639: Authorization Bypass Through User-Controlled Key
- CWE-200: Exposure of Sensitive Information |
|---|
| User | bashdar (UID 101020) |
|---|
| Submission | 09/05/2026 12:08 (2 months ago) |
|---|
| Moderation | 10/11/2026 11:11 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 416574 [ZKTeco BioTime 9.5.6 Build 20260130.3206 Employee REST API employees authorization] |
|---|
| Points | 17 |
|---|