Executive brief
IceHRM is an open-source Human Resource Management System used to manage employee records. Before version 36.0.0, the system fails to properly check employee ownership on seven REST API endpoints (skills, education, certifications, languages, leave, attendance, and status), allowing any authenticated employee to view the sensitive HR records of their colleagues by simply changing employee IDs in API requests.
Technical details
The vulnerability is an insecure direct object reference (IDOR) / horizontal privilege escalation affecting seven REST API sub-resource endpoints in IceHRM. The vulnerable endpoints (EmployeeSkillsRestEndPoint, EmployeeEducationRestEndPoint, EmployeeCertificationRestEndPoint, EmployeeLanguagesRestEndPoint, EmployeeLeaveRestEndPoint, EmployeeAttendanceRestEndPoint, and EmployeeStatusRestEndPoint) accept an employee ID parameter but do not verify that the authenticated user is viewing only their own records. An authenticated attacker can substitute arbitrary employee IDs to retrieve sensitive personnel data such as qualifications, leave history, and attendance records. The vulnerability requires authentication but no additional user interaction. Patches are available in version 36.0.0 and later.
Affected products
- IceHRM IceHRM before 36.0.0
Timeline
- 2026-09-15: disclosed