CVE-2026-91770

Published: Sep 15, 2026Modified: Sep 23, 2026Deferred

7.1

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

IceHRM before 36.0.0 fails to validate employee ownership on seven REST sub-resource endpoints, allowing authenticated employees to read any colleague's HR records. Attackers can substitute arbitrary employee IDs in skill, education, certification, language, leave, attendance, and status endpoints to access sensitive personnel data.

Related CWEs

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (7)

https://github.com/gamonoid/icehrm

Source: disclosure@vulncheck.com

https://github.com/gamonoid/icehrm/blob/e75ed7e45de41f7b2b3ea319d9406514afa2bf29/core/src/Employees/Rest/EmployeeSkillsRestEndPoint.php#L20-L51

Source: disclosure@vulncheck.com

https://github.com/gamonoid/icehrm/commit/19674f29a0591c985712dc4a5c841e21d7dbf971

Source: disclosure@vulncheck.com

https://github.com/gamonoid/icehrm/issues/375

Source: disclosure@vulncheck.com

https://github.com/gamonoid/icehrm/releases/tag/v36.0.0

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/icehrm-before-36.0.0-broken-access-control-via-employee-id

Source: disclosure@vulncheck.com

https://github.com/gamonoid/icehrm/issues/375

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.