CVE-2026-115326
CVE-2026-115326 · QloApps through 1.7.0 IDOR via OrderDetailController Refund Request
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest() that allows authenticated customers to submit refunds for other customers' service lines. Attackers can submit foreign id_service_product_order_detail values with their own id_order to create refund records, cancel victims' service lines, and corrupt refund quantities.
CVSS 5.3 · Media · EPSS 0,2%
- Publicación
- Actualización
Productos y versiones afectados
qloapps
- Versiones
- ≥ 0, ≤ 1.7.0: Afectada (custom)
Sin corrección publicada
Fuentes originales
- https://github.com/Qloapps/QloApps/pull/1930
- https://github.com/Qloapps/QloApps/commit/105241f9a77e94b30d6c2d577d14b247f33a5fba
- https://github.com/Qloapps/QloApps/blob/v1.7.0/controllers/front/OrderDetailController.php#L624-L631
- https://github.com/Qloapps/QloApps
- https://www.vulncheck.com/advisories/qloapps-through-1.7.0-idor-via-orderdetailcontroller-refund-request
- https://nvd.nist.gov/vuln/detail/CVE-2026-115326