CVE-2026-91770

MediumCVSS 6.5

Published: 15/09/2026(UTC)Updated: 23/09/2026(UTC)Translated: 15/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

18th percentile - higher than 18% of all known CVEs

Summary

IceHRM before 36.0.0 fails to validate employee ownership on seven REST sub-resource endpoints, allowing authenticated employees to read any colleague's HR records. Attackers can substitute arbitrary employee IDs in skill, education, certification, language, leave, attendance, and status endpoints to access sensitive personnel data.

Risk Assessment

Breach of employee privacy and potential leakage of sensitive personal data, leading to legal consequences and loss of trust.

Recommendation

Upgrade IceHRM to version 36.0.0 or later, which includes fixes for validating data ownership.

Other vulnerabilities in IceHRM

CVE-2026-15478Medium
A SQL injection vulnerability has been found in IceHRM up to version 35.0.1 in the EmployeeAttendanceReport.php file. An attacker can remotely manipulate the employeeList argument, leading to unauthorized database access. The exploit has been published and may be used.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS