CVE-2026-116746 in QloApps
Summary
by MITRE • 10/26/2026
QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in the qlohotelreview module's AddReview AJAX action that allows unauthenticated attackers to submit reviews for arbitrary orders. Attackers can reuse the publicly exposed review_ajax_token and enumerate sequential id_order values to post fake ratings and reviews attributed to other customers.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/26/2026
The QloApps e-commerce platform, specifically versions 1.6.0 through 1.7.0, suffers from a critical missing authorization vulnerability within its qlohotelreview module. This flaw resides in the AddReview AJAX action endpoint, which fails to enforce proper authentication or access control checks before processing user input. In secure web applications, actions that modify data or perform state-changing operations must verify that the requesting entity has valid credentials and appropriate permissions. However, this implementation allows unauthenticated attackers to interact with the review submission functionality without logging in or providing any form of session validation. This represents a fundamental failure in implementing robust access control mechanisms, aligning directly with CWE-862 (Missing Authorization) as defined by the Common Weakness Enumeration standard.
The technical mechanism exploited involves the reuse of a publicly exposed token known as review_ajax_token. Typically, such tokens are intended to prevent Cross-Site Request Forgery attacks or to validate session integrity during AJAX requests. In this vulnerable configuration, however, the server does not associate this static or predictable token with specific user sessions or orders in a way that prevents abuse. Attackers can leverage this oversight by combining the exposed token with sequential enumeration of order identifiers (id_order). By iterating through possible integer values for id_order, an attacker can systematically target arbitrary customer accounts and their associated purchase history. This capability transforms what might have been a minor integrity issue into a significant tool for malicious activity, as it allows the manipulation of data belonging to users who did not initiate the requests.
The operational impact of this vulnerability is substantial, particularly regarding trust and reputation management within an e-commerce environment. E-commerce platforms rely heavily on customer reviews to drive sales and build brand credibility. By allowing unauthenticated actors to submit fake ratings and reviews attributed to other customers, attackers can artificially inflate or deflate product scores. This manipulation distorts the marketplace integrity, misleading potential buyers based on fabricated feedback. Furthermore, attributing these false reviews to real customer accounts constitutes CWE-245 (J2EE Misconfiguration: Insecure Direct Object Reference) in context of identity spoofing, as it falsely associates actions with legitimate users. This can lead to reputational damage for merchants and confusion or frustration among genuine customers whose identities are misused.
From a threat intelligence perspective, this vulnerability maps to MITRE ATT&CK techniques related to Account Manipulation and Data Injection. Attackers use these capabilities to establish false narratives within the application's data layer, which is often overlooked compared to direct financial theft. The ability to enumerate resources sequentially also highlights CWE-209 (Generation of Error Message Containing Sensitive Information) if error responses reveal valid order IDs, aiding further enumeration efforts. This pattern is common in legacy or poorly maintained modules where security was not prioritized during development, leading to endpoints that are accessible without sufficient validation checks.
Mitigation strategies must focus on immediate patching and architectural improvements. The primary remediation is to upgrade QloApps to a version beyond 1.7.0 where this vulnerability has been addressed by the vendor. For systems unable to update immediately, administrators should implement web application firewall rules that restrict access to the qlohotelreview module's AJAX endpoints based on valid session cookies or tokens rather than relying solely on static parameters. Additionally, implementing rate limiting and CAPTCHA challenges for review submissions can mitigate bulk enumeration attacks. Developers must ensure that all state-changing API endpoints enforce strict authentication checks using frameworks like OWASP CSRF prevention guidelines and validate that the authenticated user has ownership of the resource being modified before allowing any write operations to proceed.