CVE-2026-115326 — QloApps through 1.7.0 IDOR via OrderDetailController Refund Request
QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest() that allows authenticated customers t…
Published: 2026-10-22 · CVSS: 5.3 · CVSS 4.0
QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest() that allows authenticated customers to submit refunds for other customers' service lines. Attackers can submit foreign id_service_product_order_detail values with their own id_order to create refund records, cancel victims' service lines, and corrupt refund quantities.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7