CVE-2026-115326

QloApps versions through 1.7.0 are affected by an insecure direct object reference (IDOR) vulnerability in the OrderDetailController::displayAjaxSubmitRefundRequest() function. This flaw allows authenticated customers to submit refund requests for service lines belonging to other customers by pro...

EUVD-2026-108128

QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest that allows authenticated customers to submit refunds for other customers' service lines. Attackers can submit foreign idserviceproductorderdetail values with...