{"id":"CVE-2026-116746","kind":"vulnerability","aliases":["CVE-2026-116746"],"related":[],"title":"QloApps hotel module lets anyone post reviews for other customers' orders","description":"QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in the qlohotelreview module's AddReview AJAX action that allows unauthenticated attackers to submit reviews for arbitrary orders. Attackers can reuse the publicly exposed review_ajax_token and enumerate sequential id_order values to post fake ratings and reviews attributed to other customers.","summary":"The qlohotelreview module in QloApps 1.6.0 through 1.7.0 has a missing authorization check in its AddReview AJAX action. An unauthenticated attacker can reuse the publicly exposed review token and enumerate sequential order IDs to post fake ratings and reviews attributed to other customers.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hotel-booking","package","php","qloapps","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- Check the installed QloApps version in the admin dashboard or `config/settings.inc.php` and see whether it falls in 1.6.0 through 1.7.0.\n- Look for the `qlohotelreview` module in the `modules/` directory and confirm its version.\n- Test whether the AddReview AJAX endpoint accepts requests without a logged-in session (unknown exact steps; the sources do not give a request example).","fix":"- Upgrade QloApps to a version later than 1.7.0 (unknown exact fixed version; the sources do not say).\n- Update or disable the `qlohotelreview` module until the fixed release is installed (unknown whether a patch exists for the module alone).\n- Review existing reviews for entries attributed to orders the customer did not place.","status":"open","published_at":"2026-10-26T22:16:59+00:00","first_seen_at":"2026-10-26T22:25:34+00:00","triaged_at":"2026-10-26T22:27:44+00:00","updated_at":"2026-10-26T22:27:44+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T22:27:44Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade QloApps to a version later than 1.7.0 (unknown exact fixed version; the sources do not say).\n- Update or disable the `qlohotelreview` module until the fixed release is installed (unknown whether a patch exists for the module alone).\n- Review existing reviews for entries attributed to orders the customer did not place.","reach":"internet","title":"QloApps hotel module lets anyone post reviews for other customers' orders","impact":"low","summary":"The qlohotelreview module in QloApps 1.6.0 through 1.7.0 has a missing authorization check in its AddReview AJAX action. An unauthenticated attacker can reuse the publicly exposed review token and enumerate sequential order IDs to post fake ratings and reviews attributed to other customers.","category":"package","nicknames":[],"who_cares":["qloapps","hotel-booking","php","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker posts fake reviews attributed to other customers' orders","analyst_note":"Confirm the fixed QloApps version and whether a module-only patch exists; the NVD entry is the only source.","how_to_check":"- Check the installed QloApps version in the admin dashboard or `config/settings.inc.php` and see whether it falls in 1.6.0 through 1.7.0.\n- Look for the `qlohotelreview` module in the `modules/` directory and confirm its version.\n- Test whether the AddReview AJAX endpoint accepts requests without a logged-in session (unknown exact steps; the sources do not give a request example).","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Sites running QloApps 1.6.0 through 1.7.0 with the qlohotelreview module enabled are exposed, since the review endpoint is publicly reachable. Installations on other versions, or with the module removed, are not described as affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000681,"input_tokens":3360,"output_tokens":690,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116746':14A,17A '-2026':13A,16A '1.6.0':32B,71C '1.7.0':34B,73C 'action':44B,86C 'addreview':42B,84C 'ajax':43B,85C,104C 'allow':88C 'anyon':5A 'arbitrari':95C 'attack':47B,90C,97C 'attribut':66B,118C 'author':38B,77C 'book':20B 'check':39B 'contain':74C 'custom':10A,69B,121C 'cve':12A,15A 'enumer':56B,107C 'expos':52B,102C 'fake':62B,114C 'host':26B 'hotel':2A,19B 'hotel-book':18B 'id':59B,109C 'let':4A 'miss':37B,76C 'modul':3A,29B,82C 'order':11A,58B,96C,110C 'packag':21B 'php':22B 'post':6A,61B,113C 'public':51B,101C 'qloapp':1A,23B,31B,70C 'qlohotelreview':28B,81C 'rate':63B,115C 'reus':49B,99C 'review':7A,53B,65B,93C,103C,117C 'self':25B 'self-host':24B 'sequenti':57B,108C 'submit':92C 'token':54B,105C 'unauthent':46B,89C 'valu':111C 'vulner':78C","nicknames":[],"mitigations":[],"who_affected":"Sites running QloApps 1.6.0 through 1.7.0 with the qlohotelreview module enabled are exposed, since the review endpoint is publicly reachable. Installations on other versions, or with the module removed, are not described as affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T22:16:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116746","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116746","severity":null,"published_at":"2026-10-26T22:16:59+00:00","modified_at":"2026-10-26T22:16:59+00:00","first_seen_at":"2026-10-26T22:25:34+00:00","fetched_at":"2026-10-26T22:25:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}