CVE-2026-115326
CVE-2026-115326 · QloApps through 1.7.0 IDOR via OrderDetailController Refund Request
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest() that allows authenticated customers to submit refunds for other customers' service lines. Attackers can submit foreign id_service_product_order_detail values with their own id_order to create refund records, cancel victims' service lines, and corrupt refund quantities.
CVSS 5.3 · Mittel · EPSS 0,2%
- Veröffentlicht
- Aktualisiert
Betroffene Produkte und Versionen
qloapps
- Softwareversionen
- ≥ 0, ≤ 1.7.0: Betroffen (custom)
Keine Korrektur veröffentlicht
Originalquellen
- https://github.com/Qloapps/QloApps/pull/1930
- https://github.com/Qloapps/QloApps/commit/105241f9a77e94b30d6c2d577d14b247f33a5fba
- https://github.com/Qloapps/QloApps/blob/v1.7.0/controllers/front/OrderDetailController.php#L624-L631
- https://github.com/Qloapps/QloApps
- https://www.vulncheck.com/advisories/qloapps-through-1.7.0-idor-via-orderdetailcontroller-refund-request
- https://nvd.nist.gov/vuln/detail/CVE-2026-115326