CVE-2026-5798: Stel Order

High severity, CVSS 7.1. EPSS: 0.4% chance of exploitation in the next 30 days.

Unsafe object reference (IDOR) in Stel Order v3.25.1 and earlier versions, specifically in the ‘/app/FrontController’ endpoint, through manipulation of the ‘employeeID’ parameter. An authenticated attacker could exploit this vulnerability to access information about any employee (first names, last names, roles, job titles, and vacation records, among others) by modifying that identifier in requests sent to the server.

Affected products

• Stel Order Stel Order: up to and including 3.25.1

Published 2026-05-14. Last modified 2026-06-17.