CVE-2026-110229

Deferred Deferred - Pending Action

Improper Access Control in QloApps AdminSlipController

Publication date: 2026-10-13

Last updated on: 2026-10-14

Assigner: VulnCheck

Description

QloApps through 1.7.0 contains an improper access control vulnerability in AdminSlipController that allows hotel-restricted back-office employees to access credit slips of all hotels. Attackers can list, export as PDF, mark as redeemed, and generate store-credit vouchers from other hotels' refund records, exposing customer identities and amounts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110229

EUVD

EUVD-2026-99013

Affected Vendors & Products

Vendor	Product	Version / Range
Webkul	QloApps	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

CVE-2026-110229 is an improper access control flaw in QloApps version 1.7.0. It allows hotel-restricted back-office employees to access credit slips of all hotels. Attackers can list, export as PDF, mark as redeemed, and generate store-credit vouchers from other hotels' refund records, exposing customer identities and amounts.

Detection Guidance

Check QloApps version via admin panel or database. Inspect AdminSlipController.php and OrderSlip.php for unauthorized access patterns or missing hotel restrictions. Look for unusual voucher generation or PDF exports across hotels.

Impact Analysis

This vulnerability allows unauthorized access to sensitive refund data across hotels. Attackers could steal customer identities, refund amounts, and generate fraudulent vouchers. Hotel employees with restricted access could bypass permissions to view or manipulate financial records of other hotels.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to personal customer data (identities and refund amounts). It may also breach HIPAA if customer refunds involve healthcare-related transactions. Non-compliance risks include fines, legal action, and reputational damage.

Mitigation Strategies

Upgrade QloApps to the latest version. Apply the patch from PR #1650. Restrict admin access to only necessary hotel branches. Monitor credit slip activities for unauthorized transactions.

Hi! I’m here to help you understand CVE-2026-110229. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70