CVE-2026-107702 Details
Description
QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminHotelRoomsBookingController::postProcess() that allows restricted back-office employees to access other hotels' data by supplying an id_hotel parameter. Attackers can modify the id_hotel URL parameter on the Book Now page to view room availability and booking status of hotels outside their assigned profile access.
An authorization bypass vulnerability has been identified in QloApps versions through 1.7.0, specifically within the AdminHotelRoomsBookingController's postProcess() method. This vulnerability allows restricted back-office employees to access data from hotels outside their assigned profile access by manipulating the id_hotel parameter in the URL. Affected employees can view room availability and booking statuses for unauthorized hotels, potentially leading to unauthorized modifications of booking data.
A patch for this vulnerability has been proposed and is available in pull request #1916 on the QloApps repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 8, 2026CISA-ADP
Assessed Oct 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackmd.io/@leediay/idor-book-now-qloapps-via-url | CISA-ADP | ExploitTechnical Description |
| https://github.com/Qloapps/QloApps | [email protected] | Vendor |
| https://github.com/Qloapps/QloApps/blob/v1.7.0/modules/hotelreservationsystem/controllers/admin/AdminHotelRoomsBookingController.php#L138-L139 | [email protected] | Source CodeVendor |
| https://github.com/Qloapps/QloApps/pull/1916 | [email protected] | Issue TrackingVendor |
| https://hackmd.io/@leediay/idor-book-now-qloapps-via-url | [email protected] | ExploitTechnical Description |
| https://www.vulncheck.com/advisories/qloapps-through-1.7.0-authorization-bypass-via-id-hotel-in-admin-room-booking | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| QloApps | <= 1.7.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 8, 2026 | CVE Modified | CISA-ADP |
| Oct 8, 2026 | New CVE Received | [email protected] |