Is CVE-2026-116745 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-116745?

CVE-2026-116745 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-116745

Description

QloApps through 1.7.0 contains an information disclosure vulnerability in OrderConfirmationController::init() that allows unauthenticated attackers to obtain guest order references and emails by supplying guest id_cart values. Attackers can iterate sequential id_cart values, read the Location redirect header, view booking details via guest-tracking, and convert guests into accounts with attacker-chosen passwords.