CVE-2026-110226
MEDIUM
5,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM
5,4
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: low
Integrity: low
Availability: none
Description
AI Translation Available
QloApps through 1.7.0 contains a broken access control vulnerability that allows hotel-restricted back-office employees to create room types under unassigned hotels by supplying an arbitrary id_hotel. Attackers can enumerate all hotels via the unfiltered room type form selector and post foreign hotel IDs to AdminProductsController, creating rooms and inventory under other hotels.
639
Authorization Bypass Through User-Controlled Key
IncompleteCommon Consequences
Security Scopes Affected:
Access Control
Potential Impacts:
Bypass Protection Mechanism
Gain Privileges Or Assume Identity
Applicable Platforms
All platforms may be affected
https://github.com/Qloapps/QloApps
https://github.com/Qloapps/QloApps/blob/v1.7.0/controllers/admin/AdminProductsC…
https://github.com/Qloapps/QloApps/blob/v1.7.0/controllers/admin/AdminProductsC…
https://github.com/Qloapps/QloApps/blob/v1.7.0/modules/hotelreservationsystem/c…
https://github.com/Qloapps/QloApps/commit/24ff5f5e6ba0c7a42c83ce8155b318c3ef8c9…
https://github.com/Qloapps/QloApps/pull/1649
https://hackmd.io/@leediay/SyMoELioMx
https://www.vulncheck.com/advisories/qloapps-through-1.7.0-authorization-bypass…