CVE-2026-91770: IceHRM before 36.0.0 Broken Access Control via Employee ID

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-15 · updated 2026-09-23
Weakness: CWE-639

Description

IceHRM before 36.0.0 fails to validate employee ownership on seven REST sub-resource endpoints, allowing authenticated employees to read any colleague's HR records. Attackers can substitute arbitrary employee IDs in skill, education, certification, language, leave, attendance, and status endpoints to access sensitive personnel data.

Affected products

gamonoid icehrm: before 36.0.0 — fixed in 36.0.0

How to fix

Upgrade to a fixed version: gamonoid icehrm 36.0.0. Check the vendor advisory for mitigations.

References

https://github.com/gamonoid/icehrm
https://github.com/gamonoid/icehrm/blob/e75ed7e45de41f7b2b3ea319d9406514afa2bf29/core/src/Employees/Rest/EmployeeSkillsRestEndPoint.php#L20-L51
https://github.com/gamonoid/icehrm/commit/19674f29a0591c985712dc4a5c841e21d7dbf971
https://github.com/gamonoid/icehrm/issues/375
https://github.com/gamonoid/icehrm/releases/tag/v36.0.0
https://www.vulncheck.com/advisories/icehrm-before-36.0.0-broken-access-control-via-employee-id
https://github.com/gamonoid/icehrm/issues/375

Get alerted when CVE-2026-91770 or the next vulnerability affects your stack