CVE-2026-105836QloApps through 1.7.0 Authorization Bypass via ajaxProcessBulkUpdateRooms

Açıklama

QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminProductsController::ajaxProcessBulkUpdateRooms that allows hotel-restricted back-office employees to modify rooms of other hotels. Attackers can submit foreign room IDs in the id_rooms parameter to change status, floor, comments, or inactive dates, disrupting availability and bookings.

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Kaynaklar ve yamalar

• Proposed fix PR #1892 (unmerged) issue-trackingpatch
• ajaxProcessBulkUpdateRooms at v1.7.0 technical-description
• Reporter write-up technical-description
• https://github.com/Qloapps/QloApps product
• VulnCheck Advisory: QloApps through 1.7.0 Authorization Bypass via ajaxProcessBulkUpdateRooms third-party-advisory