Executive brief
Stel Order, a cloud-based business management platform, contains a security flaw that allows users to view private employee data they are not authorized to see. By simply changing an ID number in their web browser, an authenticated user can access sensitive details about any other employee, including full names, job titles, roles, and vacation records. This could lead to significant privacy breaches and the exposure of internal organizational structures.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in Stel Order versions 3.25.1 and earlier. The flaw is located in the '/app/FrontController' endpoint and stems from insufficient authorization checks when processing the 'employeeID' parameter. An authenticated attacker can manipulate this parameter in HTTP requests to bypass intended access controls and retrieve sensitive data belonging to other employees, such as full names, roles, job titles, and vacation records. The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key). As of the advisory date, no official patch or solution has been reported.
Affected products
- Stel Order Stel Order 3.25.1 and earlier
Timeline
- 2026-05-14: disclosed: Initial disclosure by INCIBE-CERT
- 2026-05-14: advisory: NVD publication of CVE-2026-5798