Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
IceHRM before 36.0.0 fails to validate employee ownership on seven REST sub-resource endpoints, allowing authenticated employees to read any colleague's HR records. Attackers can substitute arbitrary employee IDs in skill, education, certification, language, leave, attendance, and status endpoints to access sensitive personnel data.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Ευπάθεια IceHRM: Η CVE-2026-91770 εκθέτει δεδομένα εργαζομένων https://www.secnews.gr/733165/eypatheia-icehrm-cve-2026-91770/?fsp_sid=12403
Post summary
The tweet announces a newly reported vulnerability (CVE-2026-91770) in IceHRM that leads to employee data exposure, directing readers to a news article for further details without mentioning patches, exploits, or active attacks.