{"id":"CVE-2026-116745","kind":"vulnerability","aliases":["CVE-2026-116745"],"related":[],"title":"QloApps: order confirmation flaw leaks guest order references and emails","description":"QloApps through 1.7.0 contains an information disclosure vulnerability in OrderConfirmationController::init() that allows unauthenticated attackers to obtain guest order references and emails by supplying guest id_cart values. Attackers can iterate sequential id_cart values, read the Location redirect header, view booking details via guest-tracking, and convert guests into accounts with attacker-chosen passwords.","summary":"QloApps through 1.7.0 lets an unauthenticated visitor supply guest id_cart values to the order confirmation page and learn order references and email addresses. An attacker can then use guest tracking to view booking details and convert guest accounts into accounts with a password they choose.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hospitality","package","php","qloapps","self-hosted"],"not_affected_if":["no-guest-checkout"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-26T22:16:59+00:00","first_seen_at":"2026-10-26T22:25:34+00:00","triaged_at":"2026-10-26T22:27:43+00:00","updated_at":"2026-10-26T22:27:43+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T22:27:43Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"QloApps: order confirmation flaw leaks guest order references and emails","impact":"medium","summary":"QloApps through 1.7.0 lets an unauthenticated visitor supply guest id_cart values to the order confirmation page and learn order references and email addresses. An attacker can then use guest tracking to view booking details and convert guest accounts into accounts with a password they choose.","category":"package","nicknames":[],"who_cares":["qloapps","self-hosted","hospitality","php"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker reads guest bookings and takes over guest accounts.","analyst_note":"Find the fixed QloApps version and a patch or advisory for OrderConfirmationController::init(); the NVD entry does not list one.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-guest-checkout"],"who_is_affected":"QloApps installations through 1.7.0 that accept guest checkout, since the flaw is in the order confirmation controller reached by guest carts. Sites with no guest bookings or running a later release are not covered by the description; the sources do not name the fixed version.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000559,"input_tokens":3352,"output_tokens":448,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116745':13A,16A '-2026':12A,15A '1.7.0':26B,72C 'account':62B,64B,121C 'address':47B 'allow':82C 'attack':49B,84C,98C,124C 'attacker-chosen':123C 'book':57B,111C 'cart':34B,96C,103C 'choos':69B 'chosen':125C 'confirm':3A,39B 'contain':73C 'convert':60B,118C 'cve':11A,14A 'detail':58B,112C 'disclosur':76C 'email':10A,46B,91C 'flaw':4A 'guest':6A,32B,53B,61B,87C,94C,115C,119C 'guest-track':114C 'header':109C 'hospit':17B 'host':23B 'id':33B,95C,102C 'inform':75C 'init':80C 'iter':100C 'leak':5A 'learn':42B 'let':27B 'locat':107C 'obtain':86C 'order':2A,7A,38B,43B,88C 'orderconfirmationcontrol':79C 'packag':18B 'page':40B 'password':67B,126C 'php':19B 'qloapp':1A,20B,24B,70C 'read':105C 'redirect':108C 'refer':8A,44B,89C 'self':22B 'self-host':21B 'sequenti':101C 'suppli':31B,93C 'track':54B,116C 'unauthent':29B,83C 'use':52B 'valu':35B,97C,104C 'via':113C 'view':56B,110C 'visitor':30B 'vulner':77C","nicknames":[],"mitigations":[],"who_affected":"QloApps installations through 1.7.0 that accept guest checkout, since the flaw is in the order confirmation controller reached by guest carts. Sites with no guest bookings or running a later release are not covered by the description; the sources do not name the fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T22:16:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116745","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116745","severity":null,"published_at":"2026-10-26T22:16:59+00:00","modified_at":"2026-10-26T22:16:59+00:00","first_seen_at":"2026-10-26T22:25:34+00:00","fetched_at":"2026-10-26T22:25:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}