CVE-2026-116746
QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in the qlohotelreview module's AddReview AJAX action that allows unauthenticated attackers to submit reviews for arbitrary orders.
Does this matter?
Lower severity and no EPSS score yet. Track it; it rarely justifies an emergency change on its own.
Description
QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in the qlohotelreview module's AddReview AJAX action that allows unauthenticated attackers to submit reviews for arbitrary orders. Attackers can reuse the publicly exposed review_ajax_token and enumerate sequential id_order values to post fake ratings and reviews attributed to other customers.
- CVSS 4.0
- 6.9 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- No score yet
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-639
- Source
- disclosure@vulncheck.com
References
- https://github.com/Qloapps/QloApps
- https://github.com/Qloapps/QloApps/blob/v1.7.0/modules/qlohotelreview/controllers/front/default.php#L37-L104
- https://github.com/Qloapps/QloApps/commit/d5ce1333c99b9619fc17412580fbb28c02be2580
- https://github.com/Qloapps/QloApps/pull/1757
- https://www.vulncheck.com/advisories/qloapps-1.6.0-through-1.7.0-unauthorized-hotel-review-submission-via-qlohotelreview
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.