CVE-2026-110229

QloApps through 1.7.0 contains an improper access control vulnerability in AdminSlipController that allows hotel-restricted back-office employees to access credit slips of all hotels. Attackers can list, export as PDF, mark as redeemed, and generate store-credit vouchers from other hotels' refund...

CVE-2026-110229

Versions of QloApps through 1.7.0 are vulnerable to an improper access control flaw in the AdminSlipController component. This vulnerability allows hotel-restricted back-office employees to bypass restrictions and access credit slips from other hotels. An attacker can list, export as PDF, mark as...

CVE-2026-110229 QloApps through 1.7.0 Missing Hotel Access Restriction in Credit Slips

QloApps through 1.7.0 contains an improper access control vulnerability in AdminSlipController that allows hotel-restricted back-office employees to access credit slips of all hotels. Attackers can list, export as PDF, mark as redeemed, and generate store-credit vouchers from other hotels' refund...

CVE-2026-110226

QloApps through 1.7.0 contains a broken access control vulnerability that allows hotel-restricted back-office employees to create room types under unassigned hotels by supplying an arbitrary idhotel. Attackers can enumerate all hotels via the unfiltered room type form selector and post foreign...

PT-2026-111852

QloApps through 1.7.0 contains an improper access control vulnerability in AdminSlipController that allows hotel-restricted back-office employees to access credit slips of all hotels. Attackers can list, export as PDF, mark as redeemed, and generate store-credit vouchers from other hotels' refund...

PT-2026-111850

Name of the Vulnerable Software and Affected Versions QloApps versions prior to 1.7.1 Description Broken access control allows back-office employees restricted to a specific hotel to create room types for other hotels. This is achieved by providing an arbitrary id hotel value. Attackers can...

CVE-2026-110226: Authorization Bypass Through User-Controlled Key

QloApps through 1.7.0 contains a broken access control vulnerability that allows hotel-restricted back-office employees to create room types under unassigned hotels by supplying an arbitrary idhotel. Attackers can enumerate all hotels via the unfiltered room type form selector and post foreign...

CVE-2026-109393 QloApps through 1.7.0 Insecure Direct Object Reference in Back-Office AJAX Handlers

QloApps through 1.7.0 contains an insecure direct object reference vulnerability in back-office AJAX handlers of AdminOrdersController, AdminBookingDocumentController, AdminProductsController and AdminAddHotelController that skip htlaccess hotel checks. Hotel-restricted employees can supply other...

CVE-2026-105836

QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminProductsController::ajaxProcessBulkUpdateRooms that allows hotel-restricted back-office employees to modify rooms of other hotels. Attackers can submit foreign room IDs in the idrooms parameter to change status, floor,...

CVE-2026-105836 QloApps through 1.7.0 Authorization Bypass via ajaxProcessBulkUpdateRooms

QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminProductsController::ajaxProcessBulkUpdateRooms that allows hotel-restricted back-office employees to modify rooms of other hotels. Attackers can submit foreign room IDs in the idrooms parameter to change status, floor,...

EUVD-2026-93380

QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminProductsController::ajaxProcessBulkUpdateRooms that allows hotel-restricted back-office employees to modify rooms of other hotels. Attackers can submit foreign room IDs in the idrooms parameter to change status, floor,...

CVE-2026-105836: Authorization Bypass Through User-Controlled Key

QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminProductsController::ajaxProcessBulkUpdateRooms that allows hotel-restricted back-office employees to modify rooms of other hotels. Attackers can submit foreign room IDs in the idrooms parameter to change status, floor,...