CVE-2026-107702 QloApps through 1.7.0 Authorization Bypass via id_hotel in Admin Room Booking
Restricted employees can bypass authorization to view other hotels' booking data by manipulating the id_hotel parameter.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-107702?
CVE-2026-107702 is a medium-severity missing authorization vulnerability in Webkul QloApps, published on 8 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminHotelRoomsBookingController::postProcess() that allows restricted back-office employees to access other hotels' data by supplying an id_hotel parameter. Attackers can modify the id_hotel URL parameter on the Book Now page to view room availability and booking status of hotels outside their assigned profile access.
Weakness: CWE-639
Which versions are affected by CVE-2026-107702?
How do I fix CVE-2026-107702?
No fix has been published for CVE-2026-107702 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-107702 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-107702 exists.
Sources
Also known as GHSA-77h8-vxj2-q2xc.