Is CVE-2026-116746 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-116746?

CVE-2026-116746 has a CVSS v3 severity of MEDIUM (5.3).

Back

CVE-2026-116746

Description

QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in the qlohotelreview module's AddReview AJAX action that allows unauthenticated attackers to submit reviews for arbitrary orders. Attackers can reuse the publicly exposed review_ajax_token and enumerate sequential id_order values to post fake ratings and reviews attributed to other customers.