CVE-2026-91770 IceHRM before 36.0.0 Broken Access Control via Employee ID
Authenticated users can access other employees' sensitive HR records by manipulating employee IDs in API requests.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-91770?
CVE-2026-91770 is a high-severity missing authorization vulnerability in gamonoid icehrm, published on 15 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
IceHRM before 36.0.0 fails to validate employee ownership on seven REST sub-resource endpoints, allowing authenticated employees to read any colleague's HR records. Attackers can substitute arbitrary employee IDs in skill, education, certification, language, leave, attendance, and status endpoints to access sensitive personnel data.
Weakness: CWE-639
Which versions are affected by CVE-2026-91770?
How do I fix CVE-2026-91770?
No fix has been published for CVE-2026-91770 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-91770 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-91770 exists.
Sources
Also known as GHSA-hf65-v49c-m7f4.