{"schema":"threatline.record/2","record":{"id":"CVE-2026-116746","aliases":[],"summary":"QloApps 1.6.0 through 1.7.0 Unauthorized Hotel Review Submission via qlohotelreview","details":"QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in the qlohotelreview module's AddReview AJAX action that allows unauthenticated attackers to submit reviews for arbitrary orders. Attackers can reuse the publicly exposed review_ajax_token and enumerate sequential id_order values to post fake ratings and reviews attributed to other customers.","categories":["Unclassified"],"product":"qloapps","vendor":"qloapps","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116746","source_modified_at":"2026-10-26T21:52:44.250Z","fetched_at":"2026-10-26T23:45:56.352924Z","product":"qloapps","vendor":"qloapps","versions":[{"version":"1.6.0","status":"affected","versionType":"semver","lessThanOrEqual":"1.7.0"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":6.9,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-26T21:52:44.250Z","modified_at":"2026-10-26T21:52:44.250Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-116746","fetched_at":"2026-10-26T23:45:56.352924Z","source_modified_at":"2026-10-26T21:52:44.250Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/Qloapps/QloApps/pull/1757","tags":["issue-tracking","patch"]},{"source":"CVE List","url":"https://github.com/Qloapps/QloApps/commit/d5ce1333c99b9619fc17412580fbb28c02be2580","tags":["patch"]},{"source":"CVE List","url":"https://github.com/Qloapps/QloApps","tags":["product"]},{"source":"CVE List","url":"https://github.com/Qloapps/QloApps/blob/v1.7.0/modules/qlohotelreview/controllers/front/default.php#L37-L104","tags":["technical-description"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/qloapps-1.6.0-through-1.7.0-unauthorized-hotel-review-submission-via-qlohotelreview","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-26T21:52:44.250Z","content_hash":"9872819ccce576bf06e7cfa4df8a8ff260057fba02cac98329d13ac964298710"}}