An authentication bypass flaw allows an attacker to modify the employeeID parameter in the /app/FrontController endpoint and obtain private employee details such as names, roles, job titles and vacation records. The weakness is a classic IDOR flaw described by CWE‑639 and results in the disclosure of confidential personnel information. The vulnerability can be exploited by an attacker who is already authenticated to the system, but it does not require privileged credentials or additional system exploits.

The flaw exists in Stel Order version 3.25.1 and all earlier releases. The affected product is the Stel Order application, specifically its web front controller handling employee identifiers.

The CVSS score of 7.1 indicates moderate to high risk. The EPSS score is not available, so the likelihood of exploitation cannot be quantified, but the absence of a KEV listing suggests no known widespread exploitation. Because the endpoint is exposed to authenticated users and accepts arbitrary employeeID values without validation, the attack is straightforward for anyone who can log in. The impact is limited to data confidentiality with no immediate persistence or denial of service effects.