CVE-2026-110226: QloApps through 1.7.0 Authorization Bypass via id_hotel in Room Type Creation
QloApps through 1.7.0 contains a broken access control vulnerability that allows hotel-restricted back-office employees to create room types under unassigned hotels by supplying an arbitrary idhotel. Attackers can enumerate all hotels via the unfiltered room type form selector and post foreign hotel IDs to AdminProductsController, creating rooms and inventory under other hotels.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A back-office employee whose access is restricted to particular hotels can exploit it. The attacker needs authenticated back-office access with the ability to use the room type creation workflow.
What access does an attacker need to affect another hotel?
The attacker can use the unfiltered hotel selector in the room type form to enumerate hotel identifiers, then submit an arbitrary foreign id_hotel value to AdminProductsController. No user interaction is required.
What is the impact on other hotels?
An attacker can create room types and associated inventory under hotels that are not assigned to them. The stated impact is limited to unauthorized creation or modification of room and inventory data; no availability impact is described.
How can administrators determine whether they may be affected?
Review room types and inventory created under each hotel for entries made by back-office employees who were not assigned to that hotel. Also review whether hotel-restricted employees can see all hotels in the room type creation form or submit room-type requests containing another hotel's id_hotel.