PT-2026-40913 · Stel Order · Stel Order

Published 2026-05-14 · Updated 2026-05-14 · CVE-2026-5798

Mitre

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Unsafe object reference (IDOR) in Stel Order v3.25.1 and earlier versions, specifically in the ‘/app/FrontController’ endpoint, through manipulation of the ‘employeeID’ parameter. An authenticated attacker could exploit this vulnerability to access information about any employee (first names, last names, roles, job titles, and vacation records, among others) by modifying that identifier in requests sent to the server.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-5798

Affected Products

Stel Order

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-5798 · Security Note
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-stel-order · Note