---
id: "CVE-2026-116746"
kind: "vulnerability"
aliases: ["CVE-2026-116746"]
title: "QloApps hotel module lets anyone post reviews for other customers' orders"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["hotel-booking", "package", "php", "qloapps", "self-hosted"]
not_affected_if: ["default-config"]
published_at: "2026-10-26T22:16:59+00:00"
first_seen_at: "2026-10-26T22:25:34+00:00"
updated_at: "2026-10-26T22:27:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116746", "first_seen_at": "2026-10-26T22:25:34+00:00"}]
---

# QloApps hotel module lets anyone post reviews for other customers' orders

The qlohotelreview module in QloApps 1.6.0 through 1.7.0 has a missing authorization check in its AddReview AJAX action. An unauthenticated attacker can reuse the publicly exposed review token and enumerate sequential order IDs to post fake ratings and reviews attributed to other customers.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed QloApps version in the admin dashboard or `config/settings.inc.php` and see whether it falls in 1.6.0 through 1.7.0.
- Look for the `qlohotelreview` module in the `modules/` directory and confirm its version.
- Test whether the AddReview AJAX endpoint accepts requests without a logged-in session (unknown exact steps; the sources do not give a request example).

## Fix

- Upgrade QloApps to a version later than 1.7.0 (unknown exact fixed version; the sources do not say).
- Update or disable the `qlohotelreview` module until the fixed release is installed (unknown whether a patch exists for the module alone).
- Review existing reviews for entries attributed to orders the customer did not place.

## Timeline

- 2026-10-26T22:25:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116746

## From the sources

QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in the qlohotelreview module's AddReview AJAX action that allows unauthenticated attackers to submit reviews for arbitrary orders. Attackers can reuse the publicly exposed review_ajax_token and enumerate sequential id_order values to post fake ratings and reviews attributed to other customers.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_