CVE-2026-110226CWE-639

CVE-2026-110226

Medium · published October 13, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
16.4
In the wild
Unconfirmed
What it is

QloApps through 1.7.0 contains a broken access control vulnerability that allows hotel-restricted back-office employees to create room types under unassigned hotels by supplying an arbitrary id_hotel. Attackers can enumerate all hotels via the unfiltered room type form selector and post foreign hotel IDs to AdminProductsController, creating rooms and inventory under other hotels.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00257 · 16.4th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-10-13T23:18Z
References (8)
https://github.com/Qloapps/QloApps · [email protected]https://github.com/Qloapps/QloApps/blob/v1.7.0/controllers/admin/AdminProductsController.php#L2362-L2367 · [email protected]https://github.com/Qloapps/QloApps/blob/v1.7.0/controllers/admin/AdminProductsController.php#L3038-L3052 · [email protected]https://github.com/Qloapps/QloApps/blob/v1.7.0/modules/hotelreservationsystem/classes/HotelBranchInformation.php#L488-L496 · [email protected]https://github.com/Qloapps/QloApps/commit/24ff5f5e6ba0c7a42c83ce8155b318c3ef8c915d · [email protected]https://github.com/Qloapps/QloApps/pull/1649 · [email protected]https://hackmd.io/@leediay/SyMoELioMx · [email protected]https://www.vulncheck.com/advisories/qloapps-through-1.7.0-authorization-bypass-via-id-hotel-in-room-type-creation · [email protected]
EPSS history
Timeline
  • 15 OCT 03:28Z
    EPSS moved — → 0%
    epss
  • 13 OCT 18:50Z
    QloApps through 1.7.0 Authorization Bypass via id_hotel in Room Type Creation
    cvelistv5
  • 13 OCT 18:50Z
    QloApps through 1.7.0 Authorization Bypass via id_hotel in Room Type Creation
    cvelistv5