{"id":"CVE-2026-115326","kind":"vulnerability","aliases":["CVE-2026-115326"],"related":[],"title":"QloApps: customers can submit refunds for other customers' service lines","description":"QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest() that allows authenticated customers to submit refunds for other customers' service lines. Attackers can submit foreign id_service_product_order_detail values with their own id_order to create refund records, cancel victims' service lines, and corrupt refund quantities.","summary":"QloApps through 1.7.0 has an insecure direct object reference in the order detail refund handler, so any logged-in customer can pass another customer's service line ID. An attacker can create refund records, cancel the victim's service lines and corrupt refund quantities.","severity":"medium","cvss":5.4,"epss":0.00219,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hotel-booking","package","php","qloapps","self-hosted"],"not_affected_if":["no-customer-accounts","refunds-disabled"],"how_to_check":"- Check the installed QloApps version (for example in the admin dashboard or `config/settings.inc.php`); versions up to and including `1.7.0` are listed as affected.\n- Look for the `displayAjaxSubmitRefundRequest` method in `controllers/front/OrderDetailController.php` and confirm it does not verify that the service product order detail belongs to the current customer.","fix":null,"status":"open","published_at":"2026-10-22T11:17:51+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-25T04:14:22+00:00","updated_at":"2026-10-25T04:14:22+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:14:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"QloApps: customers can submit refunds for other customers' service lines","impact":"medium","summary":"QloApps through 1.7.0 has an insecure direct object reference in the order detail refund handler, so any logged-in customer can pass another customer's service line ID. An attacker can create refund records, cancel the victim's service lines and corrupt refund quantities.","category":"package","nicknames":[],"who_cares":["qloapps","php","hotel-booking","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker cancels other customers' service lines and alters refund records","analyst_note":"Find the upstream QloApps fix or patched version and confirm whether the refund check is tied to the logged-in customer; the NVD entry is the only source provided.","how_to_check":"- Check the installed QloApps version (for example in the admin dashboard or `config/settings.inc.php`); versions up to and including `1.7.0` are listed as affected.\n- Look for the `displayAjaxSubmitRefundRequest` method in `controllers/front/OrderDetailController.php` and confirm it does not verify that the service product order detail belongs to the current customer.","needs_analyst":true,"not_affected_if":["no-customer-accounts","refunds-disabled"],"who_is_affected":"Sites running QloApps through 1.7.0 with customer accounts that can open the order detail page and submit refund requests. Shops where customers cannot log in or where refund requests are disabled are less exposed; the sources do not say whether a patched release exists.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000627,"input_tokens":3382,"output_tokens":578,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115326':13A,16A '-2026':12A,15A '1.7.0':28B,73C 'allow':85C 'anoth':49B 'attack':56B,96C 'authent':86C 'book':19B 'cancel':61B,115C 'contain':74C 'corrupt':68B,120C 'creat':58B,112C 'custom':2A,8A,46B,50B,87C,93C 'cve':11A,14A 'detail':38B,104C 'direct':32B,77C 'displayajaxsubmitrefundrequest':83C 'foreign':99C 'handler':40B 'host':25B 'hotel':18B 'hotel-book':17B 'id':54B,100C,109C 'insecur':31B,76C 'line':10A,53B,66B,95C,118C 'log':44B 'logged-in':43B 'object':33B,78C 'order':37B,103C,110C 'orderdetailcontrol':82C 'packag':20B 'pass':48B 'php':21B 'product':102C 'qloapp':1A,22B,26B,71C 'quantiti':70B,122C 'record':60B,114C 'refer':34B,79C 'refund':5A,39B,59B,69B,90C,113C,121C 'self':24B 'self-host':23B 'servic':9A,52B,65B,94C,101C,117C 'submit':4A,89C,98C 'valu':105C 'victim':63B,116C 'vulner':80C","nicknames":[],"mitigations":[],"who_affected":"Sites running QloApps through 1.7.0 with customer accounts that can open the order detail page and submit refund requests. Shops where customers cannot log in or where refund requests are disabled are less exposed; the sources do not say whether a patched release exists.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T11:17:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115326","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115326","severity":null,"published_at":"2026-10-22T11:17:51+00:00","modified_at":"2026-10-22T11:17:51+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115326","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115326","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}