{"schema":"threatline.record/2","record":{"id":"CVE-2026-115326","aliases":[],"summary":"QloApps through 1.7.0 IDOR via OrderDetailController Refund Request","details":"QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest() that allows authenticated customers to submit refunds for other customers' service lines. Attackers can submit foreign id_service_product_order_detail values with their own id_order to create refund records, cancel victims' service lines, and corrupt refund quantities.","categories":["Unclassified"],"product":"QloApps","vendor":"Webkul","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115326","source_modified_at":"2026-10-22T10:57:44.551Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"QloApps","vendor":"Webkul","versions":[{"version":"0","status":"affected","versionType":"custom","lessThanOrEqual":"1.7.0"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":5.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00219,"percentile":0.11688,"score_date":"2026-10-23"},"published_at":"2026-10-22T10:57:44.551Z","modified_at":"2026-10-22T10:57:44.551Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-115326","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-22T10:57:44.551Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115326","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/Qloapps/QloApps/pull/1930","tags":["patch","issue-tracking"]},{"source":"CVE List","url":"https://github.com/Qloapps/QloApps/commit/105241f9a77e94b30d6c2d577d14b247f33a5fba","tags":["patch"]},{"source":"CVE List","url":"https://github.com/Qloapps/QloApps/blob/v1.7.0/controllers/front/OrderDetailController.php#L624-L631","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/Qloapps/QloApps","tags":["product"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/qloapps-through-1.7.0-idor-via-orderdetailcontroller-refund-request","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-22T10:57:44.551Z","content_hash":"530ccb0c7cd8e9c5632fe908d255483c10773bc21a8f71eebcb1c1e98c767008"}}