CVE-2026-115326— QloApps through 1.7.0 IDOR via OrderDetailController Refund Request
Quick assessment
Affected
Webkul QloApps
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
QloApps 1.7.0 及以下版本在 OrderDetailController::displayAjaxSubmitRefundRequest() 方法中存在不安全的直接对象引用漏洞。该漏洞允许已认证的客户提交针对其他客户服务线路的退款请求。攻击者可以将其自身的订单 ID（id_order）与他人的服务产品订单详情 ID（id_service_product_order_detail）组合提交，从而创建退款记录、取消受害者的服务线路，并篡改退款数量。
Possible ATT&CK Techniques 1 AI
T1068 · Exploitation for Privilege Escalation
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-115326
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
QloApps through 1.7.0 IDOR via OrderDetailController Refund Request
Source: CVE Program / CVE List V5
Vulnerability Description
QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest() that allows authenticated customers to submit refunds for other customers' service lines. Attackers can submit foreign id_service_product_order_detail values with their own id_order to create refund records, cancel victims' service lines, and corrupt refund quantities.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-115326
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-115326
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-115326 (2)
Vendor Advisories for CVE-2026-115326 (1)
IV. Related Vulnerabilities
Same product: QloApps
-
CVE-2026-110229
QloApps through 1.7.0 Missing Hotel Access Restriction in Cr -
CVE-2026-110226
QloApps through 1.7.0 Authorization Bypass via id_hotel in R -
CVE-2026-110224
QloApps through 1.7.0 Reflected XSS via Search Alias Validat -
CVE-2026-110221
QloApps through 1.7.0 Reflected XSS via Advanced Price Rule -
CVE-2026-110219
QloApps through 1.7.0 Reflected XSS via Additional Facility
Same vendor: Webkul
-
CVE-2026-112193
Webkul Aureus ERP UserForm.php weak password -
CVE-2026-112190
Webkul Aureus ERP composer.json insertion of sensitive infor -
CVE-2026-111284
Aureus ERP through 1.6.0 Stored XSS via Time Off Holiday Act -
CVE-2026-110229
QloApps through 1.7.0 Missing Hotel Access Restriction in Cr -
CVE-2026-110226
QloApps through 1.7.0 Authorization Bypass via id_hotel in R
Same weakness: CWE-639
-
CVE-2026-115546
Authentication Source Verification Issue in Okta Access Gate -
CVE-2026-115453
Cross user deletion and modification of cart and wishlist ro -
CVE-2026-115334
Lotus through 0.10.2 Authorization Bypass via switch_organiz -
CVE-2026-115329
Lotus through 0.10.2 Cross-Organization IDOR via Subscriptio -
CVE-2026-115325
Netmaker through 1.7.0 Authorization Bypass via updateExtCli
V. Comments for CVE-2026-115326
No comments yet