CVEvulnerability
CVE-2026-91770
7.1 HIGH
Official page ↗
- Status
- Deferred
- Published
- 2026-09-15
- Last modified
- 2026-09-23
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 7.1 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-639
Description
IceHRM before 36.0.0 fails to validate employee ownership on seven REST sub-resource endpoints, allowing authenticated employees to read any colleague's HR records. Attackers can substitute arbitrary employee IDs in skill, education, certification, language, leave, attendance, and status endpoints to access sensitive personnel data.
Related
Weakness · CWE (1)
- CWE-639 Authorization Bypass Through User-Controlled Key weakness
References
- https://github.com/gamonoid/icehrm github.com
- https://github.com/gamonoid/icehrm/blob/e75ed7e45de41f7b2b3ea319d9406514afa2bf29/core/src/Employees/Rest/EmployeeSkillsRestEndPoint.php#L20-L51 github.com
- https://github.com/gamonoid/icehrm/commit/19674f29a0591c985712dc4a5c841e21d7dbf971 github.com
- https://github.com/gamonoid/icehrm/issues/375 github.com
- https://github.com/gamonoid/icehrm/releases/tag/v36.0.0 github.com
- https://www.vulncheck.com/advisories/icehrm-before-36.0.0-broken-access-control-via-employee-id www.vulncheck.com
- https://github.com/gamonoid/icehrm/issues/375 github.com