Medium severity · published Oct 26, 2026
CVE-2026-116746
QloApps 1.6.0 through 1.7.0 Unauthorized Hotel Review Submission via qlohotelreview
New
5.3
CVSS
0.2%
EPSS
No
On KEV
Description
QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in the qlohotelreview module's AddReview AJAX action that allows unauthenticated attackers to submit reviews for arbitrary orders. Attackers can reuse the publicly exposed review_ajax_token and enumerate sequential id_order values to post fake ratings and reviews attributed to other customers.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
QL
qloapps · qloapps
1.6.0 through 1.7.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-116746
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-116746
github.com
https://github.com/Qloapps/QloApps
github.com
https://github.com/Qloapps/QloApps/blob/v1.7.0/modules/qlohotelreview/controllers/front/default.php#L37-L104
github.com
https://github.com/Qloapps/QloApps/commit/d5ce1333c99b9619fc17412580fbb28c02be2580
github.com
https://github.com/Qloapps/QloApps/pull/1757
www.vulncheck.com
https://www.vulncheck.com/advisories/qloapps-1.6.0-through-1.7.0-unauthorized-hotel-review-submission-via-qlohotelreview
More from qloapps
6.5
CVE-2026-116745
QloApps through 1.7.0 Guest Order Disclosure via id_cart in Order Confirmation
5.9
CVE-2026-25861
QloApps 1.7.0 Weak Password Hashing via MD5 in Tools.php
4.8
CVE-2026-25558
QloApps 1.7.0 Stored XSS via SVG File Upload in Admin File Manager