CVE-2026-110229

QloApps through 1.7.0 contains an improper access control vulnerability in AdminSlipController that allows hotel-restricted back-office employees to access credit slips of all hotels. Attackers can list, export as PDF, mark as redeemed, and generate store-credit vouchers from other hotels' refund...

CVE-2026-110229 QloApps through 1.7.0 Missing Hotel Access Restriction in Credit Slips

QloApps through 1.7.0 contains an improper access control vulnerability in AdminSlipController that allows hotel-restricted back-office employees to access credit slips of all hotels. Attackers can list, export as PDF, mark as redeemed, and generate store-credit vouchers from other hotels' refund...

CVE-2026-110229

Versions of QloApps through 1.7.0 are vulnerable to an improper access control flaw in the AdminSlipController component. This vulnerability allows hotel-restricted back-office employees to bypass restrictions and access credit slips from other hotels. An attacker can list, export as PDF, mark as...