CVE-2026-115326
CVE-2026-115326 · QloApps through 1.7.0 IDOR via OrderDetailController Refund Request
This page contains facts from public vulnerability sources. Check the original advisory before updating.
QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest() that allows authenticated customers to submit refunds for other customers' service lines. Attackers can submit foreign id_service_product_order_detail values with their own id_order to create refund records, cancel victims' service lines, and corrupt refund quantities.
CVSS 5.3 · Medium · EPSS 0.2%
- Published
- Updated
Affected products and versions
qloapps
- Versions
- ≥ 0, ≤ 1.7.0: Affected (custom)
No fix published
Original sources
- https://github.com/Qloapps/QloApps/pull/1930
- https://github.com/Qloapps/QloApps/commit/105241f9a77e94b30d6c2d577d14b247f33a5fba
- https://github.com/Qloapps/QloApps/blob/v1.7.0/controllers/front/OrderDetailController.php#L624-L631
- https://github.com/Qloapps/QloApps
- https://www.vulncheck.com/advisories/qloapps-through-1.7.0-idor-via-orderdetailcontroller-refund-request
- https://nvd.nist.gov/vuln/detail/CVE-2026-115326