CVE-2026-109393: Authorization Bypass Through User-Controlled Key in Webkul QloApps

CVE-2026-109393 affects QloApps through version 1.7.0 and is an insecure direct object reference vulnerability in the back-office AJAX handlers of AdminOrdersController, AdminBookingDocumentController, AdminProductsController, and AdminAddHotelController. The vulnerability allows hotel-restricted employees to bypass htl_access hotel checks by supplying sequential identifiers of other hotels. This bypass enables unauthorized access to read, upload, and delete booking documents and delete rooms, room images, and hotel images belonging to other hotels.

The vulnerability allows unauthorized hotel-restricted employees to access and manipulate data belonging to other hotels, including reading, uploading, and deleting booking documents, and deleting rooms and associated images. This could lead to data integrity issues and unauthorized data exposure or modification within the QloApps system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected back-office AJAX handlers and monitor for unauthorized access attempts. Implement additional access control validations to ensure hotel access checks are enforced properly.