CVE-2026-116746

EUVD-2026-110494
QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in the qlohotelreview module's AddReview AJAX action that allows unauthenticated attackers to submit reviews for arbitrary orders. Attackers can reuse the publicly exposed review_ajax_token and enumerate sequential id_order values to post fake ratings and reviews attributed to other customers.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 16.3%
Common Weakness Enumeration
References
https://github.com/Qloapps/QloApps
https://github.com/Qloapps/QloApps/blob/v1.7.0/modules/qlohotelreview/controllers/front/default.php#L37-L104
https://github.com/Qloapps/QloApps/commit/d5ce1333c99b9619fc17412580fbb28c02be2580
https://github.com/Qloapps/QloApps/pull/1757
https://www.vulncheck.com/advisories/qloapps-1.6.0-through-1.7.0-unauthorized-hotel-review-submission-via-qlohotelreview