Vulnerability · Published Oct 12, 2026 · Assigned by VulnCheck

CVE-2026-109393QloApps through 1.7.0 Insecure Direct Object Reference in Back-Office AJAX Handlers

Medium 6.3

In plain English

A medium-severity authorization bypass via user-controlled key in QloApps from Webkul. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.2%top 89.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

QloApps through 1.7.0 contains an insecure direct object reference vulnerability in back-office AJAX handlers of AdminOrdersController, AdminBookingDocumentController, AdminProductsController and AdminAddHotelController that skip htl_access hotel checks. Hotel-restricted employees can supply other hotels' sequential identifiers to read, upload and delete booking documents and delete rooms, room images and hotel images.

Affected products (as reported)

Vendor	Product	Versions
Webkul	QloApps	0 – through 1.7.0

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

Proposed fix PR #1922 (unmerged) patch, issue-tracking
https://github.com/Qloapps/QloApps/commit/83eb851cf106b51a4478f84a6d1658d7c8076258 patch
https://github.com/Qloapps/QloApps/blob/v1.7.0/controllers/admin/AdminOrdersController.php#L3799-L3877 technical-description
Reporter write-up technical-description
https://github.com/Qloapps/QloApps product
VulnCheck Advisory: QloApps through 1.7.0 Insecure Direct Object Reference in Back-Office AJAX Handlers third-party-advisory