The vulnerability allows an attacker to discover guest order references and email addresses by submitting guest id_cart values to the order confirmation endpoint. An unauthenticated user can iterate sequential id_cart identifiers, capture the redirect Location header, and view the associated booking details. The disclosed information could be used to create attacker‑chosen accounts for those guests, thereby elevating the impact from simple data exposure to potential account takeover.

QloApps version 1.7.0 and earlier are affected. All deployments of the QloApps software are impacted.

The CVSS score of 6.9 indicates a medium severity exposure. No EPSS score is available, but the vulnerability does not require special prerequisites beyond the ability to send HTTP requests to the affected endpoint. Because the attacker can iteratively enumerate id_cart values without authentication, the risk of exploitation is significant for systems that expose the order confirmation URL publicly. The vulnerability is not listed in CISA KEV, so no active exploitation campaigns are known, yet the scope remains broad due to the lack of input validation.