CVE-2026-109393

QloApps versions through 1.7.0 are vulnerable to an Insecure Direct Object Reference (IDOR) within several back-office AJAX handlers, specifically in AdminOrdersController , AdminBookingDocumentController , AdminProductsController , and AdminAddHotelController . The root cause is the failure to p...

EUVD-2026-97491

QloApps through 1.7.0 contains an insecure direct object reference vulnerability in back-office AJAX handlers of AdminOrdersController, AdminBookingDocumentController, AdminProductsController and AdminAddHotelController that skip htlaccess hotel checks. Hotel-restricted employees can supply other...