CVE-2026-115326: QloApps through 1.7.0 IDOR via OrderDetailController Refund Request
QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest() that allows authenticated customers to submit refunds for other customers' service lines. Attackers can submit foreign idserviceproductorderdetail values with their own idorder to create refund records, cancel victims' service lines, and corrupt refund quantities.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated QloApps customer account can exploit it. No administrative privileges or user interaction are required.
What does an attacker need to submit a fraudulent refund request?
The attacker needs their own id_order and an id_service_product_order_detail value belonging to another customer's service line. The vulnerable request handling accepts this mismatched combination.
What is the practical impact on affected customers?
An attacker can create refund records for another customer's service lines, cancel those lines, and corrupt refund quantities. The issue affects integrity and availability rather than confidentiality.
Which QloApps versions are affected?
QloApps through version 1.7.0 is affected.