CVE-2026-107702: Authorization Bypass Through User-Controlled Key in Webkul QloApps

CVE-2026-107702 is an authorization bypass vulnerability in Webkul's QloApps up to version 1.7.0. The vulnerability exists in the AdminHotelRoomsBookingController::postProcess() method, where the id_hotel parameter is user-controlled and not properly validated against the employee's access rights. This allows restricted back-office employees to bypass access controls and retrieve sensitive data related to other hotels by altering the id_hotel URL parameter, exposing room availability and booking status information beyond their authorized scope.

The vulnerability enables unauthorized access to sensitive hotel data by employees who should have restricted access. This could lead to information disclosure of room availability and booking statuses for hotels outside the employee's assigned profile. There is no indication of privilege escalation beyond data access or other impacts such as data modification or service disruption. No known exploits are reported in the wild.

No vendor advisory or patch information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict employee access and monitor for unauthorized parameter manipulation. Avoid exposing sensitive parameters in URLs or implement server-side validation to enforce access controls on the id_hotel parameter.