Information Disclosure in QloApps Product by QloApps
CVE-2026-116745

6.9MEDIUM

Key Information:

Vendor

Qloapps

Status
Qloapps
Vendor
CVE Published:
26 October 2026

What is CVE-2026-116745?

QloApps versions prior to 1.7.0 are susceptible to an information disclosure vulnerability within the OrderConfirmationController::init() method. This flaw allows unauthenticated attackers to exploit the application by providing sequential guest id_cart values. By doing so, they are able to access guest order references and emails. Attackers can further navigate through the guest-tracking interface to extract booking details and convert guest accounts into user accounts, taking control with attacker-defined passwords. Immediate patching is recommended to secure sensitive user information.

Affected Version(s)

qloapps 0 <= 1.7.0

References

https://github.com/Qloapps/QloApps/pull/1912
issue-trackingpatch
https://github.com/Qloapps/QloApps/commit/64c62aca58779c9...
patch
https://github.com/Qloapps/QloApps
product

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dexx-tech
Azhar-Webkul
.