CVE-2026-5798
Unsafe Object Reference (IDOR) vulnerability in Stel Order
- State
- Published
- Severity
- 7.1 High
- Published
- May 14, 2026
- Updated
- May 14, 2026
- Reserved
- Apr 8, 2026
Description
Unsafe object reference (IDOR) in Stel Order v3.25.1 and earlier versions, specifically in the ‘/app/FrontController’ endpoint, through manipulation of the ‘employeeID’ parameter. An authenticated attacker could exploit this vulnerability to access information about any employee (first names, last names, roles, job titles, and vacation records, among others) by modifying that identifier in requests sent to the server.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | INCIBE |
Weaknesses
- CWE-639 Authorization bypass through User-Controlled key
Affected Products
| Product | Versions |
|---|---|
Stel OrderStel Order |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.