CVE-2026-105836: QloApps Authorization Bypass Vulnerability

CVE-2026-105836 Overview

CVE-2026-105836 is an authorization bypass vulnerability in QloApps through version 1.7.0, a hotel booking and property management platform. The flaw resides in the AdminProductsController::ajaxProcessBulkUpdateRooms method, which fails to validate that back-office employees own the rooms they modify. Hotel-restricted employees can submit arbitrary room identifiers in the id_rooms parameter to alter rooms belonging to other hotels. Affected properties include room status, floor, comments, and inactive dates, directly impacting availability and bookings across tenants. The vulnerability is tracked under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Authenticated back-office employees restricted to a single hotel can modify rooms belonging to other hotels, disrupting availability, bookings, and operational data integrity across tenants.

Affected Products

QloApps versions through 1.7.0
QloApps back-office administrative interface
Multi-hotel QloApps deployments with employee hotel restrictions

Discovery Timeline

2026-10-06 - CVE-2026-105836 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105836

Vulnerability Analysis

The vulnerability affects the bulk room update handler at AdminProductsController::ajaxProcessBulkUpdateRooms. The function accepts a client-supplied id_rooms parameter containing room identifiers to update. It then applies attribute changes without verifying that the submitted room IDs belong to a hotel the authenticated employee is authorized to manage.

QloApps supports multi-tenant deployments where employees can be restricted to specific hotels. The missing ownership check breaks this tenant isolation at the controller level. An attacker with a legitimate but hotel-scoped back-office account can submit foreign room IDs and the server will process the update as if the IDs were in scope.

Fields modifiable through the bulk update include room status, floor assignment, comments, and inactive date ranges. Manipulating inactive dates allows an attacker to make competitor rooms appear unavailable for arbitrary periods, directly affecting booking workflows. The issue is categorized under CWE-639 as an insecure direct object reference.

Root Cause

The root cause is missing authorization enforcement in the controller action. The handler trusts the id_rooms input and performs updates without cross-referencing the target rooms against the employee's hotel assignment. See the vulnerable source in the QloApps AdminProductsController.php at line 5344.

Attack Vector

Exploitation requires an authenticated back-office session with at least one hotel assignment. The attacker crafts an AJAX request to the bulk update endpoint and supplies room IDs belonging to other hotels in the id_rooms parameter. No elevated privileges, user interaction, or chained vulnerabilities are required. Technical write-ups are available in the VulnCheck advisory for QloApps and the HackMD security notes.

No verified proof-of-concept code is published alongside this advisory. Refer to the linked references for technical details and the vendor patch discussion in QloApps Pull Request #1892.

Detection Methods for CVE-2026-105836

Indicators of Compromise

Back-office HTTP POST requests to the ajaxProcessBulkUpdateRooms action containing id_rooms values that do not belong to the submitting employee's assigned hotel.
Unexpected changes to room status, floor, comments, or inactive date fields in the ps_htl_room_information tables outside the authoring employee's hotel scope.
Audit log entries showing bulk room updates performed by hotel-restricted employee accounts affecting rooms across multiple id_hotel values.

Detection Strategies

Correlate employee id_employee and their assigned id_hotel against the id_hotel of rooms modified in each bulk update request.
Alert when a single employee session modifies rooms spanning more than one hotel within a short window.
Review web server access logs for repeated requests to the AdminProducts controller with high-volume id_rooms[] arrays.

Monitoring Recommendations

Enable verbose back-office action logging in QloApps and forward logs to a centralized SIEM for cross-tenant anomaly detection.
Monitor database write patterns for bulk updates to room records attributed to non-owning employees.
Baseline normal bulk-update behavior per employee role to detect deviation from expected hotel scope.

How to Mitigate CVE-2026-105836

Immediate Actions Required

Audit all back-office employee accounts and remove unnecessary permissions on the AdminProducts controller.
Review recent bulk room update activity in logs and database audit trails to identify unauthorized modifications across hotels.
Restrict access to the QloApps back-office network path to trusted administrative sources until a patch is applied.

Patch Information

The maintainers have addressed the issue in the QloApps repository. Review the fix in QloApps Pull Request #1892 and upgrade to a release incorporating the patch. Monitor the QloApps GitHub repository for the next tagged release beyond 1.7.0 and apply it to all production instances.

Workarounds

Temporarily disable bulk room update functionality for hotel-restricted employee profiles via the back-office permissions matrix.
Limit the bulk update capability to super administrators who already have cross-hotel authority until the patch is deployed.
Place a web application firewall rule in front of the back-office that inspects id_rooms parameters and blocks requests where submitted IDs do not match the session's authorized hotels.

bash

# Example WAF-style rule concept blocking cross-hotel bulk updates
# Deny POST requests to ajaxProcessBulkUpdateRooms when id_rooms values
# are not pre-validated against the employee's assigned id_hotel scope
Location "/admin/index.php"
  SecRule ARGS:action "@streq ajaxProcessBulkUpdateRooms" \
    "id:1050836,phase:2,deny,status:403,msg:'Block bulk room update pending CVE-2026-105836 patch'"