Vulnerability · Published May 14, 2026 · Assigned by INCIBE
CVE-2026-5798Unsafe Object Reference (IDOR) vulnerability in Stel Order
High 7.1
In plain English
A high-severity authorization bypass via user-controlled key in Stel Order from Stel Order. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).
Official description
Unsafe object reference (IDOR) in Stel Order v3.25.1 and earlier versions, specifically in the ‘/app/FrontController’ endpoint, through manipulation of the ‘employeeID’ parameter. An authenticated attacker could exploit this vulnerability to access information about any employee (first names, last names, roles, job titles, and vacation records, among others) by modifying that identifier in requests sent to the server.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Stel Order | Stel Order | 0 – through 3.25.1 |
Weakness: CWE-639 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N