CVE-2026-91770: IceHRM before 36.0.0 Broken Access Control via Employee ID
IceHRM before 36.0.0 fails to validate employee ownership on seven REST sub-resource endpoints, allowing authenticated employees to read any colleague's HR records. Attackers can substitute arbitrary employee IDs in skill, education, certification, language, leave, attendance, and status endpoints to access sensitive personnel data.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated IceHRM employee account can exploit it. No user interaction is required, and the attacker only needs to replace the employee ID in requests to the affected REST sub-resource endpoints.
Which data areas may be exposed?
The affected endpoints cover skills, education, certifications, languages, leave, attendance, and status records. An attacker may read these records for arbitrary colleagues.
Are deployments running version 36.0.0 affected?
The issue affects IceHRM versions before 36.0.0. The supplied release information identifies 36.0.0 as the version containing the fix.