CVE-2026-109393

EUVD-2026-97491
QloApps through 1.7.0 contains an insecure direct object reference vulnerability in back-office AJAX handlers of AdminOrdersController, AdminBookingDocumentController, AdminProductsController and AdminAddHotelController that skip htl_access hotel checks. Hotel-restricted employees can supply other hotels' sequential identifiers to read, upload and delete booking documents and delete rooms, room images and hotel images.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
6.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
webkulqloapps
𝑥
≤ 1.7.0
CNA
Common Weakness Enumeration
References
https://github.com/Qloapps/QloApps
https://github.com/Qloapps/QloApps/blob/v1.7.0/controllers/admin/AdminOrdersController.php#L3799-L3877
https://github.com/Qloapps/QloApps/commit/83eb851cf106b51a4478f84a6d1658d7c8076258
https://github.com/Qloapps/QloApps/pull/1922
https://hackmd.io/@leediay/ry_M5yqoGe
https://www.vulncheck.com/advisories/qloapps-through-1.7.0-insecure-direct-object-reference-in-back-office-ajax-handlers