Read the docs
TI-2026-61981 Aliases CVE-2026-91770GHSA-hf65-v49c-m7f4

IceHRM before 36.0.0 Broken Access Control via Employee ID

Priority MEDIUM 64CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

IceHRM before 36.0.0 fails to validate employee ownership on seven REST sub-resource endpoints, allowing authenticated employees to read any colleague's HR records. Attackers can substitute arbitrary employee IDs in skill, education, certification, language, leave, attendance, and status endpoints to access sensitive personnel data.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00454 39th percentileScored 2026-11-07
Fix Fixed icehrm (gamonoid): 36.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
gamonoidicehrmbefore 36.0.036.0.0Patch availableCNA
  • icehrm Vendorgamonoid Affected before 36.0.0 Fixed in 36.0.0 Patch available CNA

Remediation

  • Fix · CNA icehrm (gamonoid) Fixed in 36.0.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-91770
  2. 2026-10-03 Alias added: GHSA-hf65-v49c-m7f4

References

Patch 1

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences