Vulnerability · Published Sep 15, 2026 · Assigned by VulnCheck
CVE-2026-91770IceHRM before 36.0.0 Broken Access Control via Employee ID
Medium 6.5
In plain English
A medium-severity authorization bypass via user-controlled key in icehrm from gamonoid. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.5%top 60.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
IceHRM before 36.0.0 fails to validate employee ownership on seven REST sub-resource endpoints, allowing authenticated employees to read any colleague's HR records. Attackers can substitute arbitrary employee IDs in skill, education, certification, language, leave, attendance, and status endpoints to access sensitive personnel data.
Affected products (as reported)
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- https://github.com/gamonoid/icehrm/issues/375 issue-tracking
- https://github.com/gamonoid/icehrm/commit/19674f29a0591c985712dc4a5c841e21d7dbf971 patch
- icehrm v36.0.0 Release Notes release-notes
- https://github.com/gamonoid/icehrm/blob/e75ed7e45de41f7b2b3ea319d9406514afa2bf29/core/src/Employees/Rest/EmployeeSkillsRestEndPoint.php#L20-L51 technical-description
- https://github.com/gamonoid/icehrm product
- VulnCheck Advisory: IceHRM before 36.0.0 Broken Access Control via Employee ID third-party-advisory