CVE-2026-91770 is an authorization bypass vulnerability in gamonoid's IceHRM product affecting versions prior to 36.0.0. The vulnerability arises from a failure to validate employee ownership on seven REST sub-resource endpoints, enabling authenticated users with limited privileges to access HR records of other employees by manipulating employee ID parameters. This impacts endpoints handling skills, education, certification, language, leave, attendance, and status data. The CVSS 4.0 base score is 7.1, indicating a high severity due to network attack vector, low attack complexity, no privileges required beyond authentication, and high impact on confidentiality.

An attacker with valid employee credentials can read sensitive HR data of any other employee by substituting arbitrary employee IDs in the affected endpoints. This leads to unauthorized disclosure of personal and personnel information, potentially violating privacy and internal security policies.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, organizations should monitor vendor communications for updates. Until a fix is available, restrict access to the affected endpoints to trusted users only and consider additional access controls or monitoring to detect abuse of employee ID parameters.