Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Unsafe object reference (IDOR) in Stel Order v3.25.1 and earlier versions, specifically in the ‘/app/FrontController’ endpoint, through manipulation of the ‘employeeID’ parameter. An authenticated attacker could exploit this vulnerability to access information about any employee (first names, last names, roles, job titles, and vacation records, among others) by modifying that identifier in requests sent to the server.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
⚠️#INCIBEaviso | Múltiples vulnerabilidades en #StelOrder #CVE CVE-2026-5798 y CVE-2026-5790 https://www.incibe.es/incibe-cert/alerta-temprana/avisos/multiples-vulnerabilidades-en-stel-order #AvisosDeSeguridad #TI #CNA
Post summary
INCIBE alerts that StelOrder has multiple vulnerabilities (CVE-2026-5798 and CVE-2026-5790), but provides no further technical details, proof of concept, or exploitation status within the posted text.