CVE-2026-115326

QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest() that allows authenticated customers to submit refunds for other customers' service lines. Attackers can submit foreign id service product order detail values with their own id order to create refund records, cancel victims' service lines, and corrupt refund quantities.