CVE-2026-116745: QloApps through 1.7.0 Guest Order Disclosure via id_cart in Order Confirmation
QloApps through 1.7.0 contains an information disclosure vulnerability in OrderConfirmationController::init() that allows unauthenticated attackers to obtain guest order references and emails by supplying guest idcart values. Attackers can iterate sequential idcart values, read the Location redirect header, view booking details via guest-tracking, and convert guests into accounts with attacker-chosen passwords.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker can exploit it. No existing account, special privileges, or user interaction are required.
What information and access can an attacker obtain?
An attacker can enumerate guest cart identifiers to obtain guest order references and email addresses, then use guest tracking to view booking details. The issue can also allow conversion of guest records into accounts using attacker-chosen passwords.
Are installations affected by default?
The affected behavior is in the guest-order confirmation flow and relies on guest id_cart values. The provided information does not identify a configuration change that disables the vulnerable flow.
How can I assess whether exploitation may have occurred?
Review web and application logs for repeated requests involving sequential guest id_cart values, especially requests to order confirmation followed by guest-tracking activity. Also investigate unexpected account conversions or newly created accounts associated with guest orders.
What can be done if an update cannot be applied immediately?
Restrict or closely monitor access to the guest order confirmation and guest-tracking functionality, and investigate anomalous sequential id_cart requests. Review guest-order accounts for unauthorized conversions and reset credentials for affected accounts where appropriate.