CVE-2026-91770: Gamonoid Icehrm

Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days.

IceHRM before 36.0.0 fails to validate employee ownership on seven REST sub-resource endpoints, allowing authenticated employees to read any colleague's HR records. Attackers can substitute arbitrary employee IDs in skill, education, certification, language, leave, attendance, and status endpoints to access sensitive personnel data.

Affected products

• Gamonoid Icehrm: before 36.0.0 (fixed in 36.0.0)

Published 2026-09-15. Last modified 2026-09-23.