QloApps CVE-2026-109393

Requires a valid, authenticated back-office employee account whose profile is hotel-restricted via htl_access, deployed in a multi-hotel QloApps installation where per-hotel access scoping is actually in use. The vulnerable AJAX handlers in AdminOrdersController, AdminBookingDocumentController, AdminProductsController and AdminAddHotelController omit the HotelBranchInformation::getProfileAccessedHotels() ownership check, so the only prerequisite beyond login is supplying another hotel's sequential identifier. Limiting factors: exploitation is impossible without an authenticated low-privilege employee account (PR:L), is meaningless in single-hotel deployments, and the attacker must already have legitimate back-office access - this is strictly an insider/multi-tenant trust-boundary issue, not remote-unauthenticated.

This is a medium-severity insider-authorization flaw rather than a top-tier emergency. The supplied CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L, 5.3) is internally consistent with the description: network-reachable back-office AJAX endpoints, low attack complexity, and crucially PR:L - exploitation requires an already-authenticated, hotel-restricted employee account, not an anonymous internet attacker. The impact is broad in type (read, upload, and delete booking documents; delete rooms, room images, and hotel images across other tenants) but each individual impact is rated Low, which the vendor's VC:L/VI:L/VA:L reflects. No EPSS score, no CISA KEV listing, and no explicit POC flag are present in the input, so exploitation status is 'no public exploit identified at time of analysis' - though a third-party technical write-up (hackmd.io/@leediay) and a VulnCheck advisory with exact source-line references exist, which lowers the barrier to reproduction. The signals do not conflict: a moderate CVSS, absent EPSS/KEV, and a privilege prerequisite all point to a realistic but bounded risk confined to multi-hotel deployments with partially-trusted staff. Note that EPSS and KEV data are simply absent from the input (not low), so widespread-exploitation probability cannot be quantified; the authorization-bypass nature (CWE-639) makes this primarily an insider/multi-tenant trust concern, not a mass-exploitation target.

A hotel chain running QloApps gives a front-desk or manager employee a back-office account scoped to only their own property via htl_access restrictions. That employee calls the vulnerable AJAX handlers (e.g. ajaxProcessGetBookingDocuments, ajaxProcessDeleteHotelRoom) and simply substitutes another hotel's sequential record ID, letting them read or delete a competing or sister property's booking documents, rooms, and images. No public weaponized exploit is listed, but a detailed technical write-up and vendor-advisory source references make reproduction straightforward for a logged-in employee.