Improper Access Control in QloApps Affects Hotel Credit Slip Management
CVE-2026-110229

5.3MEDIUM

Key Information:

Vendor

Webkul

Status
Qloapps
Vendor
CVE Published:
13 October 2026

What is CVE-2026-110229?

QloApps version 1.7.0 is susceptible to an improper access control vulnerability in the AdminSlipController component. This flaw permits hotel-restricted back-office employees to gain unauthorized access to credit slips of all hotels. As a result, attackers can list and export credit slips as PDF, mark them as redeemed, and create store-credit vouchers from other hotels' refund records. This vulnerability presents a significant risk as it may lead to the exposure of sensitive customer identities and financial data associated with refunds.

Affected Version(s)

QloApps 0 <= 1.7.0

References

https://hackmd.io/@leediay/SyMoELioMx
third-party-advisory
https://github.com/Qloapps/QloApps/blob/v1.7.0/controller...
technical-description
https://github.com/Qloapps/QloApps/blob/v1.7.0/controller...
technical-description

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

leediay153 from Viettel Post
.