What’s Vulnerable › Vulnerabilities

CVE-2026-5798: Unsafe Object Reference (IDOR) vulnerability in Stel Order

• Severity: high (CVSS 7.1 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-14 · updated 2026-06-17
• Weakness: CWE-639

Description

Unsafe object reference (IDOR) in Stel Order v3.25.1 and earlier versions, specifically in the ‘/app/FrontController’ endpoint, through manipulation of the ‘employeeID’ parameter. An authenticated attacker could exploit this vulnerability to access information about any employee (first names, last names, roles, job titles, and vacation records, among others) by modifying that identifier in requests sent to the server.

Affected products

• Stel Order: through 3.25.1

References

• https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-stel-order

Get alerted when CVE-2026-5798 or the next vulnerability affects your stack