CVE-2026-105836

QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminProductsController::ajaxProcessBulkUpdateRooms that allows hotel-restricted back-office employees to modify rooms of other hotels. Attackers can submit foreign room IDs in the idrooms parameter to change status, floor,...

CVE-2026-105836

The QloApps application, through version 1.7.0 , is affected by an authorization bypass vulnerability within the AdminProductsController::ajaxProcessBulkUpdateRooms function. This flaw allows hotel-restricted back-office employees to modify room details for hotels outside of their own jurisdictio...

EUVD-2026-93380

QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminProductsController::ajaxProcessBulkUpdateRooms that allows hotel-restricted back-office employees to modify rooms of other hotels. Attackers can submit foreign room IDs in the idrooms parameter to change status, floor,...