CVE-2026-110229: QloApps through 1.7.0 Missing Hotel Access Restriction in Credit Slips
QloApps through 1.7.0 contains an improper access control vulnerability in AdminSlipController that allows hotel-restricted back-office employees to access credit slips of all hotels. Attackers can list, export as PDF, mark as redeemed, and generate store-credit vouchers from other hotels' refund records, exposing customer identities and amounts.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A back-office employee account that is restricted to a particular hotel can exploit it. The vulnerability affects access to credit slips belonging to other hotels.
What actions can an attacker perform with another hotel's credit slips?
An attacker can list the slips, export them as PDF, mark them as redeemed, and generate store-credit vouchers from other hotels' refund records. The exposed records include customer identities and refund amounts.
Does exploitation require user interaction or a complex attack path?
No user interaction is required, and the attack complexity is rated low. Exploitation does require low-level privileges through a back-office employee account.
How can an organization determine whether it may be affected?
Organizations using QloApps through version 1.7.0 should review whether hotel-restricted back-office accounts can access credit-slip functions for hotels outside their assigned scope. Relevant actions include viewing or listing slips, PDF export, redemption, and store-credit voucher generation.