CVE-2026-105836QloApps through 1.7.0 Authorization Bypass via ajaxProcessBulkUpdateRooms

Descripción

QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminProductsController::ajaxProcessBulkUpdateRooms that allows hotel-restricted back-office employees to modify rooms of other hotels. Attackers can submit foreign room IDs in the id_rooms parameter to change status, floor, comments, or inactive dates, disrupting availability and bookings.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• Proposed fix PR #1892 (unmerged) issue-trackingpatch
• ajaxProcessBulkUpdateRooms at v1.7.0 technical-description
• Reporter write-up technical-description
• https://github.com/Qloapps/QloApps product
• VulnCheck Advisory: QloApps through 1.7.0 Authorization Bypass via ajaxProcessBulkUpdateRooms third-party-advisory