CVE-2026-110229: Missing Authorization in Webkul QloApps

CVE-2026-110229 is an improper access control vulnerability in Webkul's QloApps product, specifically in the AdminSlipController component. The vulnerability affects all versions up to and including 1.7.0. It permits back-office employees restricted to a single hotel to access credit slip data from all hotels managed by the system. Attackers can perform actions including listing credit slips, exporting them as PDFs, marking them as redeemed, and generating store-credit vouchers from refund records of other hotels. This leads to unauthorized disclosure of customer identities and refund amounts across hotel boundaries.

The vulnerability allows unauthorized access to sensitive financial and customer data across hotel accounts within the QloApps system. This can lead to privacy violations and potential misuse of refund processes, such as fraudulent redemption of credit slips or vouchers. The CVSS score of 5.3 (medium severity) reflects the moderate impact due to the requirement of some privileges and the limited scope of the affected functionality.

No official patch or remediation is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the AdminSlipController functionality to trusted personnel only and monitor for unauthorized use of credit slip operations.