CVE-2026-91770
Received Received - Intake

Authenticated Employee ID Substitution in IceHRM HR Records

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulnCheck

Description
IceHRM before 36.0.0 fails to validate employee ownership on seven REST sub-resource endpoints, allowing authenticated employees to read any colleague's HR records. Attackers can substitute arbitrary employee IDs in skill, education, certification, language, leave, attendance, and status endpoints to access sensitive personnel data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-91770
EUVD
EUVD-2026-78246

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gamonoid icehrm to 36.0.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

IceHRM before version 36.0.0 has a broken access control flaw where seven REST endpoints fail to validate employee ownership. Authenticated employees can manipulate employee IDs in requests to access sensitive HR records of any colleague, including skills, education, certifications, languages, leave, attendance, and status data.

Detection Guidance

To detect this vulnerability, monitor HTTP requests to IceHRM REST endpoints like /api/employees/{id}/skills, /api/employees/{id}/educations, and similar paths. Look for requests where authenticated users access employee IDs outside their own scope. Use tools like curl to test endpoints with manipulated IDs: curl -H 'Authorization: Bearer TOKEN' https://your-icehrm.com/api/employees/1/skills. Check for unauthorized data exposure in responses.

Impact Analysis

An attacker with basic access can read confidential HR records of any employee, exposing personal data, qualifications, leave history, attendance, and status messages. While data cannot be modified, unauthorized access violates privacy and could lead to reputational damage or legal consequences for organizations.

Compliance Impact

This vulnerability breaches mandatory access controls required by GDPR and HIPAA by allowing unauthorized access to sensitive personal and medical data. Organizations using affected versions risk non-compliance, potential fines, and legal liabilities due to exposed employee records.

Mitigation Strategies

Immediately upgrade IceHRM to version 36.0.0 or later to patch the vulnerability. If upgrading is not possible, restrict access to affected endpoints via network-level controls or WAF rules. Review all API logs for signs of exploitation. Implement strict input validation to ensure employee IDs in requests match the authenticated user's ID. Temporarily disable the affected endpoints if mitigation is urgent.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91770. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart