Insecure Direct Object Reference in QloApps by QloApps Team

CVE-2026-109393

What is CVE-2026-109393?

The QloApps application, up to version 1.7.0, contains an insecure direct object reference vulnerability within its back-office AJAX handlers. This security flaw allows hotel-restricted employees to bypass hotel access checks, enabling them to manipulate sensitive data. Specifically, these users can enter sequential identifiers from other hotels, providing illicit access to read, upload, and delete booking documents. Furthermore, the vulnerability allows for the deletion of rooms, as well as associated images, potentially compromising the integrity and confidentiality of hotel data.

References