CVE-2026-91770 Details
Description
IceHRM before 36.0.0 fails to validate employee ownership on seven REST sub-resource endpoints, allowing authenticated employees to read any colleague's HR records. Attackers can substitute arbitrary employee IDs in skill, education, certification, language, leave, attendance, and status endpoints to access sensitive personnel data.
A broken access control vulnerability has been identified in IceHRM versions prior to 36.0.0. The issue arises in the REST API, specifically on seven sub-resource endpoints related to employee data. These endpoints do not properly validate employee ownership, allowing authenticated employees to access the HR records of their colleagues. By substituting employee IDs in the request, sensitive information such as skills, education, certifications, languages, leave history, attendance records, and status messages can be retrieved. This vulnerability violates mandatory access controls, potentially leading to unauthorized disclosure of personal and confidential information.
Users can update to IceHRM version 36.0.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 15, 2026CISA-ADP
Assessed Sep 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gamonoid/icehrm/issues/375 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/gamonoid/icehrm | [email protected] | ProductVendor |
| https://github.com/gamonoid/icehrm/blob/e75ed7e45de41f7b2b3ea319d9406514afa2bf29/core/src/Employees/Rest/EmployeeSkillsRestEndPoint.php#L20-L51 | [email protected] | Source CodeVendor |
| https://github.com/gamonoid/icehrm/commit/19674f29a0591c985712dc4a5c841e21d7dbf971 | [email protected] | Source CodeVendor |
| https://github.com/gamonoid/icehrm/issues/375 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/gamonoid/icehrm/releases/tag/v36.0.0 | [email protected] | Release NotesVendor |
| https://www.vulncheck.com/advisories/icehrm-before-36.0.0-broken-access-control-via-employee-id | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| IceHRM | >= 0, < 36.0.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 15, 2026 | CVE Modified | CISA-ADP |
| Sep 15, 2026 | New CVE Received | [email protected] |