CVE-2026-109393
MEDIUM
NVD
CVSS Score
6.3
Severity
MEDIUM
Published
Oct 12, 2026
Vendor
unknown
Description
QloApps through 1.7.0 contains an insecure direct object reference vulnerability in back-office AJAX handlers of AdminOrdersController, AdminBookingDocumentController, AdminProductsController and AdminAddHotelController that skip htl_access hotel checks. Hotel-restricted employees can supply other hotels' sequential identifiers to read, upload and delete booking documents and delete rooms, room images and hotel images.