QloApps CVE-2026-115326

Exploitation requires a valid, authenticated QloApps customer account (PR:L) on an instance running version 1.7.0 or earlier; no administrative rights and no victim interaction (UI:N) are needed. The attacker must reach the OrderDetailController::displayAjaxSubmitRefundRequest() endpoint and supply a foreign id_service_product_order_detail value alongside their own id_order, which in practice means knowing or enumerating other customers' service-line identifiers. The limiting factors are therefore the need for any authenticated account and the need to discover/guess valid foreign id_service_product_order_detail values; there is no confidentiality disclosure, only tampering with and cancellation of victims' refund and service records.

This is a genuine but moderate-priority issue, not a high-CVSS-but-low-real-risk case nor a critical emergency. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 5.3 (medium) and is internally consistent with the description: network-reachable, low-complexity, requires an authenticated customer account (PR:L), no user interaction. Impact is deliberately limited - VC:N (no confidentiality loss), VI:L and VA:L (low integrity and availability impact), reflecting that the flaw lets an attacker tamper with and cancel other customers' refund/service records rather than read data or take over the host. The vuln.today decision label is 'this_month' (not act_now/emergency), aligning with the medium score. Signals are largely consistent rather than conflicting; the main caveat is missing exploitation telemetry: no EPSS score and no KEV listing are provided, and no SSVC automatable/technical-impact breakdown is supplied, so widespread automated exploitation cannot be inferred. The vulnerability was reported by VulnCheck and a vendor patch exists, which raises confidence in the finding itself even though real-world exploitation data is absent.

An attacker who registers or already holds a customer account on a QloApps hotel-booking site sends a crafted AJAX request to OrderDetailController::displayAjaxSubmitRefundRequest(), supplying another customer's id_service_product_order_detail together with their own id_order. Because the controller does not verify that the service line belongs to the requester (CWE-639), the server creates refund records against the victim's bookings, cancels the victim's service lines, and corrupts refund quantities. No public exploit code was identified at time of analysis, though the exact vulnerable code location is published in the references.