CVE-2026-110226Medium· 5.4▾ SunlitQloApps through 1.7.0 contains a broken access control vulnerability that allows hotel-restricted back-office employees to create room types under unassigned hotels by supplying an arbitrary id_hotel. Attackers can enumerate all hotels v…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 15.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
QloApps through 1.7.0 contains a broken access control vulnerability that allows hotel-restricted back-office employees to create room types under unassigned hotels by supplying an arbitrary id_hotel. Attackers can enumerate all hotels via the unfiltered room type form selector and post foreign hotel IDs to AdminProductsController, creating rooms and inventory under other hotels.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-110224Medium· 5.4QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in AdminSearchConfController::processSave() that echoes rejected alias and search values unescaped in validation errors
CVE-2026-116746Medium· 5.3QloApps 1.6.0 through 1.7.0 Unauthorized Hotel Review Submission via qlohotelreview
CVE-2026-116745Medium· 6.5QloApps through 1.7.0 Guest Order Disclosure via id_cart in Order Confirmation
CVE-2026-115326Medium· 5.4QloApps through 1.7.0 IDOR via OrderDetailController Refund Request
CVE-2026-110229Medium· 5.4QloApps through 1.7.0 contains an improper access control vulnerability in AdminSlipController that allows hotel-restricted back-office employees to access credit slips of all hotels
CVE-2026-110219Medium· 5.4QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject scripts through the price parameter of the back-office Additional Facilities form