Access Control Flaw in IceHRM Affects Employee HR Records

CVE-2026-91770

What is CVE-2026-91770?

IceHRM versions prior to 36.0.0 suffer from a broken access control vulnerability that allows authenticated users to exploit the system. This flaw enables employees to access sensitive HR records of their colleagues by manipulating employee IDs across seven vulnerable REST sub-resource endpoints. The unvalidated access to skills, education, certifications, language, leave, attendance, and status data poses a significant risk of unauthorized disclosure of personally identifiable information and sensitive employee data.

References