CVE-2026-115326 QloApps through 1.7.0 IDOR via OrderDetailController Refund Request

Medium 5.3 Published 22 Oct 2026 Updated 22 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-115326?

CVE-2026-115326 is a medium-severity vulnerability in Webkul QloApps, published on 22 Oct 2026.

Official description

QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest() that allows authenticated customers to submit refunds for other customers' service lines. Attackers can submit foreign id_service_product_order_detail values with their own id_order to create refund records, cancel victims' service lines, and corrupt refund quantities.

Weakness: CWE-639

Which versions are affected by CVE-2026-115326?

How do I fix CVE-2026-115326?

No fix has been published for CVE-2026-115326 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-115326 being exploited?

There is no known exploitation of CVE-2026-115326 in the wild and no public exploit code.

Sources

Also known as GHSA-7cwv-h2vr-67q3.