CVE-2026-5798CWE-639

Unsafe Object Reference (IDOR) vulnerability in Stel Order

High · published May 14, 2026

CVSS v4.0
7.1
EPSS
0%
Percentile
27.5
In the wild
Unconfirmed
What it is

Unsafe object reference (IDOR) in Stel Order v3.25.1 and earlier versions, specifically in the ‘/app/FrontController’ endpoint, through manipulation of the ‘employeeID’ parameter. An authenticated attacker could exploit this vulnerability to access information about any employee (first names, last names, roles, job titles, and vacation records, among others) by modifying that identifier in requests sent to the server.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00351 · 27.5th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-05-14T12:26Z
EPSS history
Timeline
  • 14 MAY 12:26Z
    Unsafe Object Reference (IDOR) vulnerability in Stel Order
    cvelistv5