CVE-2026-107702: QloApps Authorization Bypass Vulnerability

CVE-2026-107702 Overview

CVE-2026-107702 is an authorization bypass vulnerability in QloApps through version 1.7.0, an open-source hotel booking and reservation management platform. The flaw resides in the AdminHotelRoomsBookingController::postProcess() method, which fails to validate whether an authenticated back-office employee has permission to access the hotel identified by the id_hotel parameter. Restricted employees can modify this parameter on the Book Now page to view room availability and booking status for hotels outside their assigned profile scope. The vulnerability is tracked under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact

Low-privileged back-office users can enumerate reservation data across every hotel managed by the QloApps instance, breaking tenant isolation in multi-property deployments.

Affected Products

• QloApps versions through 1.7.0
• QloApps hotelreservationsystem module (AdminHotelRoomsBookingController.php)
• Multi-property QloApps deployments relying on employee profile restrictions

Discovery Timeline

• 2026-10-08 - CVE-2026-107702 published to NVD
• 2026-10-08 - Last updated in NVD database

Technical Details for CVE-2026-107702

Vulnerability Analysis

QloApps uses an employee profile system to restrict back-office users to specific hotels. The AdminHotelRoomsBookingController is responsible for rendering the Book Now interface that displays room availability and reservations. The controller accepts an id_hotel request parameter to determine which hotel's data to load.

The postProcess() method dispatches on this parameter without first checking whether the current employee's profile grants access to the referenced hotel. As a result, any authenticated employee, including those scoped to a single property, can substitute an arbitrary id_hotel value and receive the corresponding hotel's booking data. This is a classic Insecure Direct Object Reference pattern where the server trusts a client-supplied identifier as the authorization boundary.

Root Cause

The root cause is a missing authorization check adjacent to the parameter read at lines 138-139 of modules/hotelreservationsystem/controllers/admin/AdminHotelRoomsBookingController.php. The controller resolves id_hotel from the request and proceeds to query reservation state without cross-referencing the employee's permitted hotel list. See the GitHub code review link for the exact location.

Attack Vector

Exploitation requires an authenticated back-office account with limited profile access. The attacker navigates to the Book Now page and intercepts or edits the URL to change the id_hotel query parameter to the numeric identifier of another hotel. The server returns room inventory, availability windows, and booking status for the targeted hotel without rejecting the request. No elevated privileges, user interaction from a victim, or complex payloads are required. Technical write-up is available in the HackMD IDOR Vulnerability Report and the VulnCheck Advisory.

Detection Methods for CVE-2026-107702

Indicators of Compromise

• Back-office access logs showing requests to AdminHotelRoomsBooking with id_hotel values outside an employee's assigned profile.
• Unexpected spikes in Book Now page requests from accounts that typically manage a single property.
• Session activity where the same employee accesses sequential or enumerated id_hotel identifiers in short succession.

Detection Strategies

• Correlate authenticated employee IDs with the id_hotel parameter values they request and flag mismatches against the profile-to-hotel mapping stored in the QloApps database.
• Enable verbose admin controller logging and search for AdminHotelRoomsBookingController invocations where the requesting employee has no assignment to the referenced hotel.
• Deploy a web application firewall rule that compares id_hotel request values against the authenticated session's authorized hotel list.

Monitoring Recommendations

• Monitor back-office HTTP access logs for parameter tampering patterns such as sequential id_hotel enumeration from a single session.
• Alert on repeated authorization failures or anomalous data volumes returned to employee accounts with narrow profile scope.
• Review audit trails for lateral access to hotel reservation data by employees who have not been granted the corresponding profile permissions.

How to Mitigate CVE-2026-107702

Immediate Actions Required

• Apply the upstream fix from QloApps Pull Request #1916 or upgrade to a QloApps release that incorporates the authorization check.
• Audit all back-office employee profiles and remove unnecessary accounts or over-provisioned access to the hotel reservation module.
• Review admin access logs since deployment of QloApps 1.7.0 or earlier to identify prior parameter tampering activity.

Patch Information

The maintainers merged the authorization check through Pull Request #1916 in the QloApps GitHub repository. The patch adds a validation step that confirms the authenticated employee has access to the hotel referenced by the id_hotel parameter before any booking data is returned. Operators running version 1.7.0 or earlier should upgrade to the first release containing this commit.

Workarounds

• Restrict back-office access to trusted administrators only until the patch is applied, reducing the pool of accounts that can abuse the parameter.
• Place QloApps behind a reverse proxy or WAF that enforces an allowlist of permitted id_hotel values per authenticated session.
• Temporarily disable the Book Now admin view for non-administrative profiles if patching cannot be scheduled immediately.

# Example WAF rule concept: reject id_hotel values not in the session's allowlist
# ModSecurity pseudo-rule
SecRule ARGS:id_hotel "!@pmFromFile /etc/modsec/allowed_hotels_%{SESSION.employee_id}.txt" \
    "id:1072026,phase:2,deny,status:403,msg:'QloApps CVE-2026-107702 id_hotel out of scope'"