CVE-2026-116745 — Vulnerability intelligence

—

Published: 2026-10-26T22:16:59.130

CVSS

6.9

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

QloApps through 1.7.0 contains an information disclosure vulnerability in OrderConfirmationController::init() that allows unauthenticated attackers to obtain guest order references and emails by supplying guest id_cart values. Attackers can iterate sequential id_cart values, read the Location redirect header, view booking details via guest-tracking, and convert guests into accounts with attacker-chosen passwords.

Sources

• CVE-2026-116745
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory