Description
IceHRM before 36.0.0 fails to validate employee ownership on seven REST sub-resource endpoints, allowing authenticated employees to read any colleague's HR records. Attackers can substitute arbitrary employee IDs in skill, education, certification, language, leave, attendance, and status endpoints to access sensitive personnel data.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| gamonoid | icehrm | < 36.0.0 | 36.0.0 |
References
- https://github.com/gamonoid/icehrm/issues/375 issue-tracking
- https://github.com/gamonoid/icehrm/commit/19674f29a0591c985712dc4a5c841e21d7dbf971 patch
- icehrm v36.0.0 Release Notes release-notes
- https://github.com/gamonoid/icehrm/blob/e75ed7e45de41f7b2b3ea319d9406514afa2bf29/core/src/Employees/Rest/EmployeeSkillsRestEndPoint.php#L20-L51 technical-description
- https://github.com/gamonoid/icehrm product
- VulnCheck Advisory: IceHRM before 36.0.0 Broken Access Control via Employee ID third-party-advisory