CVE-2026-109393: QloApps through 1.7.0 Insecure Direct Object Reference in Back-Office AJAX Handlers
QloApps through 1.7.0 contains an insecure direct object reference vulnerability in back-office AJAX handlers of AdminOrdersController, AdminBookingDocumentController, AdminProductsController and AdminAddHotelController that skip htlaccess hotel checks. Hotel-restricted employees can supply other hotels' sequential identifiers to read, upload and delete booking documents and delete rooms, room images and hotel images.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated hotel-restricted employee with access to the affected back-office AJAX handlers can exploit it. The attacker does not need user interaction and can target records belonging to other hotels by supplying their sequential identifiers.
What data and actions are exposed?
Affected handlers can allow cross-hotel reading, uploading, and deletion of booking documents. They can also allow deletion of rooms, room images, and hotel images belonging to other hotels.
Are unrestricted administrators the primary concern?
The described access-control failure specifically affects hotel-restricted employees because the handlers skip htl_access hotel checks. Organizations using hotel-scoped employee accounts are therefore exposed to cross-hotel access and deletion.
How can I determine whether my deployment is affected?
Deployments running QloApps through version 1.7.0 are affected according to the advisory. Review whether hotel-restricted employee accounts can access the listed back-office controllers and whether changing a hotel-related sequential identifier permits operations on another hotel's records.