{"schema":"threatline.record/2","record":{"id":"CVE-2026-116745","aliases":[],"summary":"QloApps through 1.7.0 Guest Order Disclosure via id_cart in Order Confirmation","details":"QloApps through 1.7.0 contains an information disclosure vulnerability in OrderConfirmationController::init() that allows unauthenticated attackers to obtain guest order references and emails by supplying guest id_cart values. Attackers can iterate sequential id_cart values, read the Location redirect header, view booking details via guest-tracking, and convert guests into accounts with attacker-chosen passwords.","categories":["Unclassified"],"product":"qloapps","vendor":"qloapps","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116745","source_modified_at":"2026-10-26T21:52:43.567Z","fetched_at":"2026-10-26T23:45:56.352924Z","product":"qloapps","vendor":"qloapps","versions":[{"version":"0","status":"affected","versionType":"semver","lessThanOrEqual":"1.7.0"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":6.9,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-26T21:52:43.567Z","modified_at":"2026-10-26T21:52:43.567Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-116745","fetched_at":"2026-10-26T23:45:56.352924Z","source_modified_at":"2026-10-26T21:52:43.567Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/Qloapps/QloApps/pull/1912","tags":["issue-tracking","patch"]},{"source":"CVE List","url":"https://github.com/Qloapps/QloApps/commit/64c62aca58779c9b507d9dc2c80b216b28f55bae","tags":["patch"]},{"source":"CVE List","url":"https://github.com/Qloapps/QloApps","tags":["product"]},{"source":"CVE List","url":"https://github.com/Qloapps/QloApps/blob/v1.7.0/controllers/front/OrderConfirmationController.php#L59-L62","tags":["technical-description"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/qloapps-through-1.7.0-guest-order-disclosure-via-id-cart-in-order-confirmation","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-26T21:52:43.567Z","content_hash":"0476e18bc1a80e6325387cd6eca24ec74b40dad00098c550bda3b2728ea7c78d"}}