CVE-2026-110229 — QloApps through 1.7.0 Missing Hotel Access Restriction in Credit Slips
QloApps through 1.7.0 contains an improper access control vulnerability in AdminSlipController that allows hotel-restricted back-office employees to access credit slips of all h…
Published: 2026-10-13 · CVSS: 5.3 · CVSS 4.0
QloApps through 1.7.0 contains an improper access control vulnerability in AdminSlipController that allows hotel-restricted back-office employees to access credit slips of all hotels. Attackers can list, export as PDF, mark as redeemed, and generate store-credit vouchers from other hotels' refund records, exposing customer identities and amounts.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7