Live › vulnerability › CVE-2026-116745
Go to dashboardQloApps through 1.7.0 lets an unauthenticated visitor supply guest id_cart values to the order confirmation page and learn order references and email addresses. An attacker can then use guest tracking to view booking details and convert guest accounts into accounts with a password they choose.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 22:25 UTC. All times on this page are UTC.
QloApps installations through 1.7.0 that accept guest checkout, since the flaw is in the order confirmation controller reached by guest carts. Sites with no guest bookings or running a later release are not covered by the description; the sources do not name the fixed version.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
QloApps through 1.7.0 contains an information disclosure vulnerability in OrderConfirmationController::init() that allows unauthenticated attackers to obtain guest order references and emails by supplying guest id_cart values. Attackers can iterate sequential id_cart values, read the Location redirect header, view booking details via guest-tracking, and convert guests into accounts with attacker-chosen passwords.
This page as .md · .json · in your agent: get_signal("CVE-2026-116745")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.