CVE-2026-115326

QloApps versions through 1.7.0 are affected by an insecure direct object reference (IDOR) vulnerability in the OrderDetailController::displayAjaxSubmitRefundRequest() function. This flaw allows authenticated customers to submit refund requests for service lines belonging to other customers by pro...