---
id: "CVE-2026-116745"
kind: "vulnerability"
aliases: ["CVE-2026-116745"]
title: "QloApps: order confirmation flaw leaks guest order references and emails"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["hospitality", "package", "php", "qloapps", "self-hosted"]
not_affected_if: ["no-guest-checkout"]
published_at: "2026-10-26T22:16:59+00:00"
first_seen_at: "2026-10-26T22:25:34+00:00"
updated_at: "2026-10-26T22:27:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116745", "first_seen_at": "2026-10-26T22:25:34+00:00"}]
---

# QloApps: order confirmation flaw leaks guest order references and emails

QloApps through 1.7.0 lets an unauthenticated visitor supply guest id_cart values to the order confirmation page and learn order references and email addresses. An attacker can then use guest tracking to view booking details and convert guest accounts into accounts with a password they choose.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-26T22:25:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116745

## From the sources

QloApps through 1.7.0 contains an information disclosure vulnerability in OrderConfirmationController::init() that allows unauthenticated attackers to obtain guest order references and emails by supplying guest id_cart values. Attackers can iterate sequential id_cart values, read the Location redirect header, view booking details via guest-tracking, and convert guests into accounts with attacker-chosen passwords.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_