{"id":"CVE-2026-107702","published":"2026-10-08T18:17:26.637","lastModified":"2026-10-08T19:17:02.570","description":"QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminHotelRoomsBookingController::postProcess() that allows restricted back-office employees to access other hotels' data by supplying an id_hotel parameter. Attackers can modify the id_hotel URL parameter on the Book Now page to view room availability and booking status of hotels outside their assigned profile access.","cvssScore":4.3,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cwes":["CWE-639"],"vendors":[],"products":[],"references":[{"url":"https://github.com/Qloapps/QloApps","tags":[]},{"url":"https://github.com/Qloapps/QloApps/blob/v1.7.0/modules/hotelreservationsystem/controllers/admin/AdminHotelRoomsBookingController.php#L138-L139","tags":[]},{"url":"https://github.com/Qloapps/QloApps/pull/1916","tags":[]},{"url":"https://hackmd.io/@leediay/idor-book-now-qloapps-via-url","tags":[]},{"url":"https://www.vulncheck.com/advisories/qloapps-through-1.7.0-authorization-bypass-via-id-hotel-in-admin-room-booking","tags":[]},{"url":"https://hackmd.io/@leediay/idor-book-now-qloapps-via-url","tags":[]}],"exploitRefs":[{"url":"https://github.com/Qloapps/QloApps","tags":[]},{"url":"https://github.com/Qloapps/QloApps/blob/v1.7.0/modules/hotelreservationsystem/controllers/admin/AdminHotelRoomsBookingController.php#L138-L139","tags":[]},{"url":"https://github.com/Qloapps/QloApps/pull/1916","tags":[]}],"hasPoc":true,"ai":null}