CVE-2026-109393
Deferred Deferred - Pending Action

Insecure Direct Object Reference in QloApps Affecting Hotel Data

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
QloApps through 1.7.0 contains an insecure direct object reference vulnerability in back-office AJAX handlers of AdminOrdersController, AdminBookingDocumentController, AdminProductsController and AdminAddHotelController that skip htl_access hotel checks. Hotel-restricted employees can supply other hotels' sequential identifiers to read, upload and delete booking documents and delete rooms, room images and hotel images.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109393
EUVD
EUVD-2026-97491

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Webkul QloApps 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) in QloApps versions up to 1.7.0. It affects back-office AJAX handlers in controllers like AdminOrdersController and AdminBookingDocumentController. Hotel-restricted employees can bypass access controls by supplying sequential identifiers of other hotels, allowing unauthorized actions such as reading, uploading, or deleting booking documents and images.

Detection Guidance

To detect this vulnerability, monitor network traffic for unauthorized access attempts to back-office AJAX handlers in QloApps. Check for requests to endpoints like AdminOrdersController, AdminBookingDocumentController, AdminProductsController, and AdminAddHotelController with sequential hotel IDs not matching the user's authorized scope. Look for HTTP 200 responses to unauthorized requests or errors indicating missing permission checks.

Impact Analysis

Unauthorized users with limited hotel access could view, modify, or delete sensitive data belonging to other hotels. This includes booking documents, room images, and hotel images. The impact ranges from data leaks to business disruption, as attackers can manipulate hotel operations without proper permissions.

Compliance Impact

This vulnerability could lead to violations of GDPR and HIPAA by exposing or altering sensitive personal and health data. GDPR requires strict access controls for personal data, while HIPAA mandates protection of health-related information. Unauthorized access risks non-compliance, potential fines, and reputational damage.

Mitigation Strategies
  • Upgrade QloApps to the latest patched version if available, or apply the security commit changes to enforce hotel-scope validation in affected controllers.
  • Review and restrict access to back-office AJAX handlers, ensuring only authorized personnel can access specific hotel data.
  • Implement logging and monitoring for suspicious access attempts to these endpoints.
  • Temporarily disable or restrict access to the vulnerable endpoints if an immediate patch is unavailable.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109393. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart