CVE-2026-110229 in QloApps
Summary
by MITRE • 10/13/2026
QloApps through 1.7.0 contains an improper access control vulnerability in AdminSlipController that allows hotel-restricted back-office employees to access credit slips of all hotels. Attackers can list, export as PDF, mark as redeemed, and generate store-credit vouchers from other hotels' refund records, exposing customer identities and amounts.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The identified vulnerability represents a critical failure in role-based access control within the QloApps e-commerce platform, specifically affecting versions up to 1.7.0. This flaw is located in the AdminSlipController module, which serves as an administrative interface for managing financial transactions and refunds. The core technical deficiency lies in the server-side logic that fails to validate whether the currently authenticated user possesses permissions specific to their assigned hotel or store entity before processing requests related to credit slips. Instead of enforcing strict isolation between distinct business entities operating on a multi-tenant architecture, the application relies on insufficient checks that allow any back-office employee with access to this controller to bypass tenant-specific boundaries. This architectural oversight enables unauthorized lateral movement across different hotels hosted within the same instance of QloApps, effectively breaking the fundamental security principle of least privilege and data isolation required in SaaS or multi-tenant environments.
From an operational perspective, this vulnerability allows malicious actors who have compromised low-level administrative credentials to access sensitive financial records belonging to other hotels. The attacker can perform a range of destructive actions including listing all credit slips, exporting them as PDF documents, marking refunds from other establishments as redeemed without authorization, and generating store-credit vouchers using data from unrelated entities. These capabilities expose personally identifiable information such as customer names, contact details, and transaction amounts associated with competing or separate businesses. The ability to mark records as redeemed can lead to significant financial discrepancies and accounting errors, while the generation of unauthorized credit vouchers poses a direct risk of fraud and revenue loss for affected merchants. This scenario illustrates a severe breach of confidentiality and integrity within the application's administrative layer.
In terms of industry standard classifications, this vulnerability aligns with CWE-269 Improper Privilege Management and CWE-862 Missing Authorization. The lack of proper checks against user roles or tenant identifiers before executing sensitive operations is characteristic of these weaknesses. Furthermore, from a threat modeling perspective using the MITRE ATT&CK framework, this behavior corresponds to T1078 Valid Accounts, where an attacker uses legitimate credentials to access resources they are not authorized for, and potentially T1530 Data from Cloud Storage if the exported PDFs contain sensitive data exfiltrated by the adversary. The vulnerability also touches upon T1496 Resource Hijacking in a broader sense due to the potential misuse of store credits, though the primary impact is unauthorized access and data exposure.
To mitigate this risk, immediate remediation efforts should focus on implementing robust server-side authorization checks within the AdminSlipController class. Developers must ensure that every request for credit slip data includes validation against the authenticated user's associated hotel ID or tenant identifier stored in their session or token claims. It is essential to enforce strict isolation by querying database records with a WHERE clause that filters results based on the current user’s permitted scope, rather than retrieving all available records and filtering them client-side or ignoring context entirely. Additionally, implementing comprehensive audit logging for administrative actions involving financial data can help detect such unauthorized access attempts in real-time. Regular security code reviews focusing on multi-tenant isolation patterns and penetration testing that specifically targets cross-tenant privilege escalation are recommended to prevent similar vulnerabilities from persisting in the application lifecycle.