CVE-2026-115326 QloApps through 1.7.0 IDOR via OrderDetailController Refund Request

QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest that allows authenticated customers to submit refunds for other customers' service lines. Attackers can submit foreign idserviceproductorderdetail values with...