Authorization Flaw in QloApps Hotel Review Module Allows Review Spoofing
CVE-2026-116746

6.9MEDIUM

Key Information:

Vendor

Qloapps

Status
Qloapps
Vendor
CVE Published:
26 October 2026

What is CVE-2026-116746?

The QloApps hotel review module, specifically versions 1.6.0 through 1.7.0, contains a missing authorization vulnerability. This flaw allows unauthenticated attackers to exploit the AddReview AJAX action, enabling them to submit fraudulent reviews for arbitrary orders. Attackers can manipulate the review_ajax_token, which is publicly exposed, and utilize sequential id_order values to generate and submit fake ratings and reviews that appear to be posted by legitimate customers, thus undermining the trust and integrity of the review system.

Affected Version(s)

qloapps 1.6.0 <= 1.7.0

References

https://github.com/Qloapps/QloApps/pull/1757
issue-trackingpatch
https://github.com/Qloapps/QloApps/commit/d5ce1333c99b961...
patch
https://github.com/Qloapps/QloApps
product

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dexx-tech
Azhar-Webkul
.