CVE-2026-110226

Deferred Deferred - Pending Action

Broken Access Control in QloApps Lets Hotel Employees Create Rooms Under Unassigned Hotels

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

QloApps through 1.7.0 contains a broken access control vulnerability that allows hotel-restricted back-office employees to create room types under unassigned hotels by supplying an arbitrary id_hotel. Attackers can enumerate all hotels via the unfiltered room type form selector and post foreign hotel IDs to AdminProductsController, creating rooms and inventory under other hotels.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110226

EUVD

EUVD-2026-99011

Affected Vendors & Products

Vendor	Product	Version / Range
Webkul	QloApps	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability in QloApps through version 1.7.0 allows hotel-restricted back-office employees to create room types for hotels they are not authorized to manage. The issue occurs because the application fails to validate the hotel ID parameter during room type creation. Attackers can exploit this by enumerating available hotels and submitting arbitrary hotel IDs to create rooms and manage inventory for unauthorized hotels.

Detection Guidance

To detect this vulnerability, check if unauthorized users can create room types for hotels they don't have access to. Review the AdminProductsController.php file for improper validation of the id_hotel parameter. Look for unfiltered hotel dropdown selectors in the room type creation form. Verify if the getProfileAccessedHotels() method is correctly restricting hotel access based on user profiles.

Impact Analysis

This vulnerability allows unauthorized users to create and manage room types and inventory for hotels they do not have access to. This could lead to data manipulation, unauthorized changes to hotel information, and potential exposure of sensitive hotel or customer data. It undermines the integrity of the hotel management system and may affect business operations.

Compliance Impact

This vulnerability could lead to unauthorized access and modification of sensitive data, violating GDPR's data protection principles and HIPAA's requirements for safeguarding protected health information. Non-compliance may result in legal penalties, reputational damage, and loss of trust from customers and partners.

Mitigation Strategies

Apply the patch from Pull Request #1649 which updates AdminProductsController.php and the template file to enforce hotel access restrictions. Ensure the getProfileAccessedHotels() method is used to validate hotel access. Replace the hotelsNameAndId() method with proper profile-based validation. Restrict room type creation to only authorized hotels for each user profile.

Hi! I’m here to help you understand CVE-2026-110226. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70