Live › vulnerability › CVE-2026-115326
Go to dashboardQloApps through 1.7.0 has an insecure direct object reference in the order detail refund handler, so any logged-in customer can pass another customer's service line ID. An attacker can create refund records, cancel the victim's service lines and corrupt refund quantities.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running QloApps through 1.7.0 with customer accounts that can open the order detail page and submit refund requests. Shops where customers cannot log in or where refund requests are disabled are less exposed; the sources do not say whether a patched release exists.
No product ranges from the sources yet.
config/settings.inc.php); versions up to and including 1.7.0 are listed as affected.displayAjaxSubmitRefundRequest method in controllers/front/OrderDetailController.php and confirm it does not verify that the service product order detail belongs to the current customer.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest() that allows authenticated customers to submit refunds for other customers' service lines. Attackers can submit foreign id_service_product_order_detail values with their own id_order to create refund records, cancel victims' service lines, and corrupt refund quantities.
This page as .md · .json · in your agent: get_signal("CVE-2026-115326")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.