# CVE-2026-115326: QloApps insecure direct object reference in refund handling

Source: https://junglewise.ai/threats/cve-2026-115326-qloapps-through-1-7-0-contains-an-insecure-direct-object  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-22. Updated: 2026-10-22  
License: CC BY 4.0 with a link back

CVE-2026-115326 · Severity: medium · CVSS 5.4 · Published 2026-10-22

QloApps is a hotel management and reservation system that processes customer bookings and refunds. An authenticated customer can exploit a flaw in the refund request system to submit refunds for other customers' service lines, potentially canceling their services and corrupting refund records. This allows unauthorized access to modify other guests' bookings.

Technologies: [QloApps](https://junglewise.ai/threats/technologies/qloapps). Vendors: [QloApps](https://junglewise.ai/threats/vendors/qloapps).

## Quick answers

**Is CVE-2026-115326 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115326 being exploited in the wild.

**How severe is CVE-2026-115326?** Medium severity, with a CVSS score of 5.4, published 22 October 2026.

**Which products and versions are affected?** QloApps through 1.7.0.

**Is there a fix for CVE-2026-115326?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-115326 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-115326?** Check whether you run QloApps at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The OrderDetailController::displayAjaxSubmitRefundRequest() function performs insufficient authorization checks on the id_service_product_order_detail parameter, allowing authenticated users to submit refund requests for service lines belonging to other orders. An attacker who is authenticated as a customer can craft requests with foreign id_service_product_order_detail values paired with their own id_order to create unauthorized refund records and cancel victims' service lines.

## Affected products

- QloApps QloApps through 1.7.0

## Timeline

- 2026-10-22: disclosed

## References

- [https://github.com/Qloapps/QloApps](https://github.com/Qloapps/QloApps)
- [https://github.com/Qloapps/QloApps/blob/v1.7.0/controllers/front/OrderDetailController.php](https://github.com/Qloapps/QloApps/blob/v1.7.0/controllers/front/OrderDetailController.php)

## Related threats

- [QloApps missing authorization in qlohotelreview AddReview](https://junglewise.ai/threats/cve-2026-116746-qloapps-1-6-0-through-1-7-0-contains-a-missing-authorization)
- [QloApps information disclosure in OrderConfirmationController](https://junglewise.ai/threats/cve-2026-116745-qloapps-through-1-7-0-contains-an-information-disclosure)
- [QloApps improper access control in AdminSlipController](https://junglewise.ai/threats/cve-2026-110229-qloapps-through-1-7-0-contains-an-improper-access-control)
- [QloApps broken access control in room type creation](https://junglewise.ai/threats/cve-2026-110226-qloapps-through-1-7-0-contains-a-broken-access-control)
- [QloApps reflected cross-site scripting in search configuration](https://junglewise.ai/threats/cve-2026-110224-qloapps-through-1-7-0-contains-a-reflected-cross-site-scripting)