Description
IceHRM before 36.0.0 fails to validate employee ownership on seven REST sub-resource endpoints, allowing authenticated employees to read any colleague's HR records. Attackers can substitute arbitrary employee IDs in skill, education, certification, language, leave, attendance, and status endpoints to access sensitive personnel data.
Published: 2026-09-15
Score: 7.1 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 15 Sep 2026 01:45:00 +0000

Type Values Removed Values Added
Description IceHRM before 36.0.0 fails to validate employee ownership on seven REST sub-resource endpoints, allowing authenticated employees to read any colleague's HR records. Attackers can substitute arbitrary employee IDs in skill, education, certification, language, leave, attendance, and status endpoints to access sensitive personnel data.
Title IceHRM before 36.0.0 Broken Access Control via Employee ID
First Time appeared Icehrm
Icehrm icehrm
Weaknesses CWE-639
CPEs cpe:2.3:a:icehrm:icehrm:*:*:*:*:*:*:*:*
Vendors & Products Icehrm
Icehrm icehrm
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Icehrm Icehrm
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-15T01:20:32.468Z

Reserved: 2026-09-15T00:45:12.081Z

Link: CVE-2026-91770

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-15T02:16:49.517

Modified: 2026-09-15T02:16:49.517

Link: CVE-2026-91770

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key