5.3
MediumCVSS 3.1 · from VulnCheck
CVE-2026-116746
QloApps 1.6.0 through 1.7.0 Unauthorized Hotel Review Submission via qlohotelreview
qloapps · Authorization bypass via user key · CWE-639Affectedqloapps
FixA patch is linked in the references.
PublishedOct 26, 21:52 · VulnCheck
ScoredOct 26 · 5.3 · VulnCheck
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:11 UTC
What we know
No known exploitation. CISA KEV, checked 22:11 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
Description
QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in the qlohotelreview module's AddReview AJAX action that allows unauthenticated attackers to submit reviews for arbitrary orders. Attackers can reuse the publicly exposed review_ajax_token and enumerate sequential id_order values to post fake ratings and reviews attributed to other customers.
From VulnCheck
Affected and fixed versions
ProductAffectedFixed inqloapps1.6.0 – 1.7.0–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known