CVE-2026-110229: QloApps Auth Bypass Vulnerability

CVE-2026-110229 Overview

QloApps through version 1.7.0 contains an improper access control vulnerability in the AdminSlipController component. Hotel-restricted back-office employees can access credit slips belonging to all hotels in the system, bypassing multi-tenant isolation boundaries. Attackers with limited back-office credentials can list refund records, export them as PDF, mark slips as redeemed, and generate store-credit vouchers from other hotels' data. The flaw exposes customer identities and refund amounts across tenant boundaries, violating the hotel-scoped permission model that QloApps enforces elsewhere in the application. The vulnerability is classified as [CWE-862] Missing Authorization.

Critical Impact
Low-privileged back-office users assigned to a single hotel can read and manipulate credit slip records belonging to any other hotel, exposing customer data and enabling fraudulent voucher generation.

Affected Products

QloApps through version 1.7.0
AdminSlipController back-office component
OrderSlip class query interface

Discovery Timeline

2026-10-13 - CVE-2026-110229 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-110229

Vulnerability Analysis

QloApps implements a multi-tenant hotel model where back-office employees are scoped to specific hotels through HotelBranchInformation restrictions. The AdminSlipController responsible for credit slip management omits this restriction entirely. As a result, any authenticated back-office user with access to the slip module can enumerate credit slips across every hotel registered on the platform.

The exposed functionality is not limited to read access. Attackers can trigger PDF export of other hotels' credit slips, flip slips to a redeemed state, and generate store-credit vouchers from records they do not own. This yields both an information disclosure path for customer identities and refund amounts, and an integrity path that enables voucher fraud.

Root Cause

The root cause is a missing hotel-scope filter on database queries that back the credit slip grid and the PDF/action endpoints. In classes/order/OrderSlip.php, the SQL retrieving slips by date range only applied the shop-level restriction via Shop::addSqlRestriction. It never joined against htl_booking_detail or called HotelBranchInformation::addHotelRestriction. The admin controller grid in controllers/admin/AdminSlipController.php had the same omission, allowing the row list to return cross-hotel results.

Attack Vector

Exploitation requires authenticated access to the QloApps back office with permission to view the slip module. The attacker navigates to the credit slips page or calls its underlying endpoints directly. Because no hotel filter is applied, the response includes slips from hotels outside the attacker's assignment. Follow-up actions such as PDF export, status change to redeemed, or voucher generation operate on the attacker-controlled slip ID without re-validating hotel ownership.

php

// Security patch in classes/order/OrderSlip.php
// Adds hotel-scope restriction to the slip retrieval query
		FROM `'._DB_PREFIX_.'order_slip` os
		LEFT JOIN `'._DB_PREFIX_.'orders` o ON (o.`id_order` = os.`id_order`)
		WHERE os.`date_add` BETWEEN \''.pSQL($dateFrom).' 00:00:00\' AND \''.pSQL($dateTo).' 23:59:59\'
-		'.Shop::addSqlRestriction(Shop::SHARE_ORDER, 'o').'
+		'.Shop::addSqlRestriction(Shop::SHARE_ORDER, 'o'). ' ' .HotelBranchInformation::addHotelRestriction(false).'
		ORDER BY os.`date_add` ASC');

        $slips = array();

Source: QloApps Commit a759ae96

php

// Security patch in controllers/admin/AdminSlipController.php
// Joins htl_booking_detail and enforces HotelBranchInformation restriction on the grid
        $this->_select = ' o.`id_shop`';
        $this->_join .= ' LEFT JOIN '._DB_PREFIX_.'orders o ON (o.`id_order` = a.`id_order`)';
+        $this->_join .= ' INNER JOIN '._DB_PREFIX_.'htl_booking_detail hbd
+        ON (a.`id_order` = hbd.`id_order`) ' . HotelBranchInformation::addHotelRestriction(false, 'hbd');
        $this->_group = ' GROUP BY a.`id_order_slip`';

        $this->addRowAction('statusChange');

Source: QloApps Commit a759ae96

Detection Methods for CVE-2026-110229

Indicators of Compromise

Back-office requests to AdminSlipController endpoints from an employee account that return id_order_slip values tied to hotels outside the user's assignment.
PDF generation requests for credit slips whose underlying order does not match the requesting employee's HotelBranchInformation scope.
Unexpected statusChange or voucher-creation actions on credit slips associated with hotels the acting employee does not administer.

Detection Strategies

Correlate web server access logs with the employee-to-hotel assignment table to flag index.php?controller=AdminSlip requests that reference slip IDs outside the user's hotel scope.
Audit database access patterns for order_slip queries returning rows across multiple id_hotel values within a single admin session.
Enable application-level audit logging on slip status transitions and voucher creation, then alert on cross-hotel actions.

Monitoring Recommendations

Track volume anomalies in credit slip exports, redemptions, and voucher generation per employee account.
Monitor for new store-credit vouchers that reference customers who never transacted with the issuing hotel.
Review login activity and session duration for back-office accounts that interact with the slip module.

How to Mitigate CVE-2026-110229

Immediate Actions Required

Upgrade QloApps to a release that includes commit a759ae96d0d01e982d40f96d357c94bb30f3a7b3 from pull request #1650.
Restrict access to the credit slip module in back-office profiles to only employees who require it operationally.
Audit existing credit slips, redemptions, and generated vouchers for activity that crosses hotel boundaries since deployment of version 1.7.0 or earlier.

Patch Information

The fix is published in QloApps Pull Request #1650 and merged in commit a759ae96. The patch adds HotelBranchInformation::addHotelRestriction to the OrderSlip date-range query in classes/order/OrderSlip.php and introduces an INNER JOIN on htl_booking_detail within AdminSlipController so the credit slip grid, PDF export, and action endpoints only return rows the current employee is authorized to see. Additional context is available in the VulnCheck Advisory.

Workarounds

Temporarily remove the slip module permission from all hotel-restricted employee profiles until the patch is deployed.
Limit back-office access to the credit slip pages via a reverse proxy or web application firewall rule that filters requests based on authenticated user and target slip ID.
Increase monitoring on the order_slip table and voucher issuance workflow to detect unauthorized cross-hotel activity until the upgrade is complete.

bash

# Example: upgrade QloApps to a patched build from source
git clone https://github.com/Qloapps/QloApps.git
cd QloApps
git fetch origin
git checkout a759ae96d0d01e982d40f96d357c94bb30f3a7b3
# Deploy per QloApps upgrade procedure, then invalidate active back-office sessions