CVE-2026-108795
ZKTeco BioTime System Settings API systemSettings access control
- State
- Published
- Severity
- 5.3 Medium
- Published
- Oct 12, 2026
- Updated
- Oct 16, 2026
- Reserved
- Oct 11, 2026
Description
A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some unknown functionality of the file /base/api/systemSettings of the component System Settings API. Performing a manipulation results in improper access controls. The attack can be initiated remotely. Upgrading to version 9.5.6 Build 3623 can resolve this issue. It is advisable to upgrade the affected component.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X | VulDB |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C | VulDB |
| 3.0 | 4.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C | VulDB |
| 2.0 | 4.0 Medium | AV:N/AC:L/Au:S/C:P/I:N/A:N/E:ND/RL:OF/RC:C | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
BioTimeZKTeco |
|
References
- VDB-416572 | ZKTeco BioTime System Settings API systemSettings access controlvdb-entry
- VDB-416572 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- CVE-2026-108795 | CVE Analysis and Reportthird-party-advisory
- Submit #961121 | ZKTeco BioTime 9.5.6 Build 20260130.3206 Information Disclosure / Broken Access Controlthird-party-advisory
- https://www.zkteco.com/en/Security_Bulletinsibs/27patch
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.