CVE-2026-107702: QloApps through 1.7.0 Authorization Bypass via id_hotel in Admin Room Booking

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-08 · updated 2026-10-08
Weakness: CWE-639

Description

QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminHotelRoomsBookingController::postProcess() that allows restricted back-office employees to access other hotels' data by supplying an id_hotel parameter. Attackers can modify the id_hotel URL parameter on the Book Now page to view room availability and booking status of hotels outside their assigned profile access.

Affected products

Webkul QloApps: through 1.7.0

References

https://github.com/Qloapps/QloApps
https://github.com/Qloapps/QloApps/blob/v1.7.0/modules/hotelreservationsystem/controllers/admin/AdminHotelRoomsBookingController.php#L138-L139
https://github.com/Qloapps/QloApps/pull/1916
https://hackmd.io/@leediay/idor-book-now-qloapps-via-url
https://www.vulncheck.com/advisories/qloapps-through-1.7.0-authorization-bypass-via-id-hotel-in-admin-room-booking
https://hackmd.io/@leediay/idor-book-now-qloapps-via-url

Get alerted when CVE-2026-107702 or the next vulnerability affects your stack