Live › vulnerability › CVE-2026-116746
Go to dashboardThe qlohotelreview module in QloApps 1.6.0 through 1.7.0 has a missing authorization check in its AddReview AJAX action. An unauthenticated attacker can reuse the publicly exposed review token and enumerate sequential order IDs to post fake ratings and reviews attributed to other customers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 22:25 UTC. All times on this page are UTC.
Sites running QloApps 1.6.0 through 1.7.0 with the qlohotelreview module enabled are exposed, since the review endpoint is publicly reachable. Installations on other versions, or with the module removed, are not described as affected.
No product ranges from the sources yet.
config/settings.inc.php and see whether it falls in 1.6.0 through 1.7.0.qlohotelreview module in the modules/ directory and confirm its version.qlohotelreview module until the fixed release is installed (unknown whether a patch exists for the module alone).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in the qlohotelreview module's AddReview AJAX action that allows unauthenticated attackers to submit reviews for arbitrary orders. Attackers can reuse the publicly exposed review_ajax_token and enumerate sequential id_order values to post fake ratings and reviews attributed to other customers.
This page as .md · .json · in your agent: get_signal("CVE-2026-116746")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.