The vulnerability is an insecure direct object reference flaw in OrderDetailController::displayAjaxSubmitRefundRequest(). An authenticated customer can supply a foreign id_service_product_order_detail together with their own id_order to create refund records for another customer’s service lines. This allows the attacker to generate refunds, cancel the victim’s service lines, and distort refund quantities. The weakness is identified as CWE‑639.

Webkul QloApps up to and including version 1.7.0 is affected. The vulnerable code resides in controllers/front/OrderDetailController.php, as referenced in the advisory.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, so exploitation probability is unknown, but the defect requires an authenticated user. Once logged in, a malicious user can exploit the flaw to process refunds for other customers, which poses significant financial and data integrity risk. The vulnerability is not listed in the CISA KEV catalog.