CVE-2026-91770: IceHRM Information Disclosure Vulnerability

CVE-2026-91770 Overview

CVE-2026-91770 is a broken access control vulnerability in IceHRM versions before 36.0.0. The application fails to validate employee ownership on seven REST sub-resource endpoints. Authenticated employees can substitute arbitrary employee IDs in requests to read colleagues' HR records. Affected endpoints include skills, education, certifications, languages, leave, attendance, and status data. The flaw is classified as an Insecure Direct Object Reference [CWE-639].

Critical Impact
Any authenticated employee can enumerate and read sensitive personnel records belonging to other employees across seven REST endpoints without additional privileges.

Affected Products

IceHRM versions prior to 36.0.0
IceHRM EmployeeSkillsRestEndPoint and related REST sub-resource endpoints
Self-hosted IceHRM deployments exposing the REST API to authenticated users

Discovery Timeline

2026-09-15 - CVE-2026-91770 published to the National Vulnerability Database (NVD)
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-91770

Vulnerability Analysis

The vulnerability stems from missing ownership checks in seven REST sub-resource endpoints handling employee data. Each endpoint accepts an employee identifier as a request parameter and returns records associated with that ID. The application authenticates the requester but does not verify that the authenticated employee is the owner of the requested employee ID. An authenticated user can therefore iterate through employee IDs and retrieve records belonging to colleagues.

Exposed data categories include skills, education, professional certifications, spoken languages, leave history, attendance logs, and employment status. These records qualify as personal and HR-sensitive data under most privacy regulations.

Root Cause

The root cause is missing authorization at the object level, a classic Insecure Direct Object Reference pattern [CWE-639]. The EmployeeSkillsRestEndPoint.php handler and its six siblings accept the client-supplied employee parameter and use it directly as a database filter. No comparison is performed between the requester's session identity and the target employee value, and no role check restricts non-managerial access.

Attack Vector

Exploitation requires only valid employee credentials. An attacker authenticates to IceHRM, then issues REST requests against any of the seven affected sub-resource endpoints while substituting the employee parameter with sequential or enumerated identifiers. The server returns the target employee's records because ownership is never validated. The attack is executed over the network at low complexity and requires no user interaction.

text

// Patch reference from the vendor commit: build.xml
         <exclude name="CLAUDE.md"/>
         <exclude name="PATTERNS.md"/>
         <exclude name="release.sh"/>
+        <exclude name="release-test-update.sh"/>
         <exclude name="release-ext.sh"/>
         <exclude name="release-os-upgrade.sh"/>
         <exclude name="remove-obfuscated-files.sh"/>

Source: GitHub Commit 19674f2

text

// Patch reference from core/admin/company_structure/meta.json — permissions block removed as part of the sync
   "user_levels":["Admin","Manager"],
   "dashboardPosition":2,

-  "permissions":
-      {
-          "Manager":{
-              "Add Company Structure":"No",
-              "Edit Company Structure":"No",
-              "Delete Company Structure":"No"
-          }
-      },
   "model_namespace": "\\Company\\Common\\Model",
   "manager": "\\Company\\Admin\\Api\\CompanyAdminManager"
 }

Source: GitHub Commit 19674f2

Detection Methods for CVE-2026-91770

Indicators of Compromise

Repeated REST requests from a single authenticated session against /Employees/Rest/EmployeeSkillsRestEndPoint, EmployeeEducationRestEndPoint, EmployeeCertificationRestEndPoint, EmployeeLanguageRestEndPoint, EmployeeLeaveRestEndPoint, EmployeeAttendanceRestEndPoint, or EmployeeStatusRestEndPoint.
Sequential or high-cardinality values in the employee query parameter within a short time window.
Non-managerial accounts returning HTTP 200 responses that contain employee IDs other than the requester's own.

Detection Strategies

Enable verbose access logging on the IceHRM web tier and correlate the authenticated user ID with the employee request parameter to flag mismatches.
Deploy a web application firewall rule that inspects the seven affected REST endpoints and blocks requests where the employee parameter does not match the session identity.
Baseline normal request volume per user against the affected endpoints and alert on statistical outliers indicative of enumeration.

Monitoring Recommendations

Forward IceHRM application and web server logs to a centralized log platform for retention and behavioral analysis.
Alert on any single session issuing requests against more than a small threshold of unique employee IDs per hour.
Track authentication events and correlate with subsequent access to HR sub-resources to identify credential misuse.

How to Mitigate CVE-2026-91770

Immediate Actions Required

Upgrade IceHRM to version 36.0.0 or later, which addresses the missing ownership validation on the affected endpoints.
Audit application logs since deployment for evidence of enumeration against the seven affected REST endpoints.
Rotate credentials and review role assignments for any account observed accessing employee IDs outside its scope.

Patch Information

The vendor released the fix in IceHRM 36.0.0. See the GitHub Release v36.0.0 notes and the associated GitHub Commit 19674f2. Additional context is available in the VulnCheck Advisory on IceHRM and the GitHub Issue Discussion.

Workarounds

Restrict access to the IceHRM REST API to trusted networks using a reverse proxy or VPN until patching is complete.
Deploy a WAF rule that rejects requests to the seven affected endpoints when the employee parameter differs from the authenticated user, except for accounts with Admin or Manager roles.
Temporarily disable non-essential employee self-service features that expose the affected sub-resource endpoints.

bash

# Example WAF rule (ModSecurity-style) to block cross-employee reads
SecRule REQUEST_URI "@rx /Employees/Rest/(EmployeeSkills|EmployeeEducation|EmployeeCertification|EmployeeLanguage|EmployeeLeave|EmployeeAttendance|EmployeeStatus)RestEndPoint" \
  "id:1092026,phase:2,deny,status:403,log,msg:'IceHRM CVE-2026-91770 IDOR attempt',\
  chain"
    SecRule ARGS:employee "!@streq %{SESSION.employee_id}"