CVE-2026-116745

Name of the Vulnerable Software and Affected Versions QloApps versions prior to 1.7.0

Description An information disclosure issue exists in the OrderConfirmationController::init() function. Unauthenticated attackers can obtain guest order references and email addresses by providing guest id cart values. By iterating through sequential id cart values and reading the Location redirect header, attackers can view booking details via guest-tracking and subsequently convert guest profiles into full accounts using passwords chosen by the attacker.

Recommendations Update QloApps to a version later than 1.7.0. As a temporary mitigation, restrict access to the OrderConfirmationController::init() function.