{"id":"CVE-2026-116746","title":"QloApps 1.6.0 through 1.7.0 Unauthorized Hotel Review Submission via qlohotelreview","summary":"QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in the qlohotelreview module's AddReview AJAX action that allows unauthenticated attackers to submit reviews for arbitrary orders. Attackers can reuse the publicl…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvssSource":"cna","cwe":["CWE-639"],"vendor":"qloapps","product":"qloapps","affected":["qloapps >= 1.6.0 <= 1.7.0"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-27T13:46:01.175544Z"},"published":"2026-10-26","updated":"2026-10-27","sourceUpdated":"2026-10-27T14:16:39.214Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-116746","references":[{"url":"https://github.com/Qloapps/QloApps/pull/1757","label":"Pull Request #1757"},{"url":"https://github.com/Qloapps/QloApps/commit/d5ce1333c99b9619fc17412580fbb28c02be2580","label":"Patch Commit"},{"url":"https://github.com/Qloapps/QloApps"},{"url":"https://github.com/Qloapps/QloApps/blob/v1.7.0/modules/qlohotelreview/controllers/front/default.php#L37-L104"},{"url":"https://www.vulncheck.com/advisories/qloapps-1.6.0-through-1.7.0-unauthorized-hotel-review-submission-via-qlohotelreview","label":"VulnCheck Advisory: QloApps 1.6.0 through 1.7.0 Unauthorized Hotel Review Submission via qlohotelreview"}],"tags":["cve.org"],"epss":0.0025,"epssPercentile":0.16297,"ingestedAt":"2026-10-27T16:11:59.450Z","slug":"CVE-2026-116746","body":"## Overview\n\nQloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in the qlohotelreview module's AddReview AJAX action that allows unauthenticated attackers to submit reviews for arbitrary orders. Attackers can reuse the publicly exposed review_ajax_token and enumerate sequential id_order values to post fake ratings and reviews attributed to other customers.\n\n## Affected\n\n- `qloapps >= 1.6.0 <= 1.7.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}