Authorization Bypass Vulnerability in QloApps by QloApps

CVE-2026-105836

What is CVE-2026-105836?

QloApps versions up to and including 1.7.0 are vulnerable to an authorization bypass in the AdminProductsController component. This vulnerability enables back-office employees, restricted to their respective hotels, to manipulate room configurations of other hotels. By exploiting this flaw, an attacker can submit unauthorized room IDs, thereby altering essential details such as room status, floor number, comments, and inactive dates. This poses a significant risk to the integrity of hotel booking systems, potentially disrupting availability and impacting customer reservations.

References