QloApps EUVD-2026-93380

Requires a valid authenticated back-office (admin panel) employee account whose profile is hotel-restricted (non-super-admin) in a QloApps deployment managing multiple hotels - the flaw is meaningful only when tenant separation between hotels exists. The attacker exploits the ajaxProcessBulkUpdateRooms action by passing room IDs owned by other hotels in the id_rooms parameter, because the controller performs no check that those rooms belong to a hotel the employee may access. Limiting factors: exploitation needs prior authentication (PR:L) and privileges of a restricted employee, so it is an insider/cross-tenant abuse vector rather than unauthenticated remote compromise; single-hotel installations and super-admin-only staffing models are not meaningfully exposed. Impact is confined to integrity/availability of room data (status, floor, comments, inactive dates); no confidentiality breach or code execution.

This is a genuine but moderate-severity authorization flaw (CWE-639, IDOR) rather than a critical priority. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L) scores 5.3 and is internally consistent with the description: network-reachable, low complexity, but requiring low-level privileges (PR:L) - i.e. an already-authenticated, hotel-restricted back-office employee - with no confidentiality impact and only limited integrity/availability impact. No EPSS score was provided, the CVE is not in CISA KEV, and no public exploit code is referenced (only a vendor advisory and a researcher HackMD writeup), so there is no signal of active or widespread exploitation. The realistic risk is an insider/cross-tenant abuse scenario in multi-hotel deployments, not internet-wide mass exploitation. Note the impact ceiling: the flaw only lets an attacker tamper with room status/availability data (integrity/availability), consistent with the C:N rating - there is no data exfiltration or code execution. One data gap to verify: the input provides only a CVSS 4.0 vector and no 3.1 vector, EPSS, or POC status, so exploitation likelihood is inferred from the vector and description alone.

A back-office employee whose profile is restricted to Hotel A logs into the QloApps admin panel and invokes the ajaxProcessBulkUpdateRooms endpoint, supplying room IDs belonging to Hotel B in the id_rooms parameter. Because the endpoint does not verify that the submitted rooms belong to a hotel the employee is authorized for, the server applies status, floor, comment, or inactive-date changes to the foreign rooms, disrupting their availability and bookings. No public exploit code is identified at time of analysis, but the technique is trivial to reproduce for any authenticated restricted operator.