CVE-2026-5798 — Unsafe Object Reference (IDOR) vulnerability in Stel Order
Unsafe object reference (IDOR) in Stel Order v3.25.1 and earlier versions, specifically in the ‘/app/FrontController’ endpoint, through manipulation of the ‘employeeID’ paramete…
Published: 2026-05-14 · CVSS: 7.1 · CVSS 4.0
Unsafe object reference (IDOR) in Stel Order v3.25.1 and earlier versions, specifically in the ‘/app/FrontController’ endpoint, through manipulation of the ‘employeeID’ parameter. An authenticated attacker could exploit this vulnerability to access information about any employee (first names, last names, roles, job titles, and vacation records, among others) by modifying that identifier in requests sent to the server.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7