EUVD-2026-95138
GHSA-77h8-vxj2-q2xc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as restricted back-office employee
-
ExploitNavigate to Book Now page
-
ExecutionTamper id_hotel URL parameter
-
ImpactView unauthorized hotel booking data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Requires a valid authenticated back-office employee account whose profile has restricted (non-super-admin) hotel access within a multi-hotel QloApps deployment through v1.7.0; the attacker then changes the id_hotel URL parameter on the Book Now page because postProcess() never validates that the requested hotel belongs to the employee's assigned profile. Limiting factors: exploitation needs legitimate employee credentials (PR:L, not anonymous), only matters where multiple hotels/profiles exist (single-hotel installs expose nothing new), and it discloses only room availability and booking status - no record modification, no credential or full-PII exposure. The patched code's HotelBranchInformation::getProfileAccessedHotels() check and isSuperAdmin() exemption confirm super-admins were never restricted and are not the target population. |
| Impact | This is a medium-severity, authorization-bypass (IDOR, CWE-639) tenant-isolation flaw, not a high-urgency issue. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N, 5.3) tells a consistent story: network-reachable and low-complexity, but it requires PR:L - an authenticated, restricted back-office employee account - and yields only low confidentiality impact (VC:L) with no integrity or availability impact (VI:N/VA:N). The practical risk is therefore an insider or compromised-low-privilege-account scenario in a multi-hotel deployment, exposing other hotels' room availability and booking status rather than full PII, credentials, or write access. No EPSS score is provided, so exploitation probability cannot be quantified from the input. The CVE is not listed in CISA KEV, so there is no confirmed active exploitation. A public technical writeup (hackmd.io) describes the exact URL-tampering technique, lowering the skill barrier, but no weaponized exploit code or automation is evidenced in the input. Net: a legitimate but modest priority - relevant to organizations running QloApps in multi-hotel mode with restricted employee profiles, and low priority for single-hotel installs. The signals do not conflict: a medium CVSS, no KEV, absent EPSS, and a documented-but-manual technique all point to targeted, low-impact information disclosure rather than widespread exploitation. |
| Exploit ScenarioDerived | A restricted back-office employee (or an attacker who has phished/compromised such an account) at a hotel using a multi-property QloApps instance opens the Book Now page and changes the id_hotel URL parameter to a hotel outside their assigned profile access. The server fails to verify hotel ownership, returning room availability and booking status for the targeted hotel. A public hackmd writeup documents this exact manual technique, though no automated exploit code is evidenced. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
An authorization bypass in QloApps through 1.7.0 allows an authenticated back-office employee with a restricted (non-super-admin) profile to read room availability and booking status for hotels outside their assigned access by simply changing the id_hotel parameter on the Book Now page. Only multi-hotel deployments that use restricted staff profiles are meaningfully affected, since the flaw discloses booking information rather than allowing modification of records, and single-hotel installs expose nothing the employee could not already see. No public exploit code or in-the-wild exploitation has been identified (no public exploit identified at time of analysis), and the issue is a medium-severity tenant-isolation defect rather than a high-urgency remote compromise; the upstream project has published a fix as pull request 1916 and the vulnerability is documented in a public technical write-up.
RemediationAI
The vendor fix is published as upstream pull request 1916 (https://github.com/Qloapps/QloApps/pull/1916), which adds a hasHotelAccess() check that casts id_hotel to an integer, verifies membership in HotelBranchInformation::getProfileAccessedHotels() for the employee's profile, and returns an empty search form when access is denied; upstream fix available (PR/commit); released patched version not independently confirmed, so administrators should track the project repository for the next tagged release and apply it as soon as it is available, or backport the PR diff directly into the affected controller. Where immediate upgrading is not possible, compensating controls include restricting back-office employee profiles to fully trusted staff, minimizing the number of employees whose profiles span multiple hotels, and adding a reverse-proxy or WAF rule that rejects or logs requests to the Book Now admin endpoint where the id_hotel parameter does not match the authenticated session's permitted properties (this requires maintaining a per-employee hotel mapping and may generate false positives for legitimate role changes). Super-admin accounts are unaffected by the restriction and can be used for any cross-hotel administration tasks during the interim, while access logs for the admin room booking controller should be reviewed for id_hotel values manipulated in sequence, which indicates probing rather than normal use.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an instance of CWE-639, authorization bypass through a user-controlled key, in a hotel-management application built on the PrestaShop architecture. In the affected releases, AdminHotelRoomsBookingController::postProcess() read the hotel identifier directly with Tools::getValue('id_hotel') (original source at lines 138-139 of modules/hotelreservationsystem/controllers/admin/AdminHotelRoomsBookingController.php) and used it without confirming that the requested hotel was within the current employee's profile scope. Because the value arrives from the URL and is never compared against the employee's permitted hotel list, an employee whose profile restricts them to a subset of properties can substitute any id_hotel value and have the controller render availability and booking data for that property. The upstream fix demonstrates the intended trust model: it casts the parameter to an integer, calls HotelBranchInformation::getProfileAccessedHotels() with the employee's id_profile to obtain the permitted hotel set, rejects the request when the hotel is not in that set (setting a hotelAccessDenied flag and an error message), and short-circuits initSearchFormData() so no data is rendered. It also exempts super-administrators via isSuperAdmin(), confirming that super-admins were never restricted and are not the population the control targets.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Authenticated restricted employee is required (PR:L), request is a trivial network URL-parameter change (AV:N/AC:L), and only limited cross-tenant booking data leaks (C:L, I/A:N, scope unchanged).
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
DescriptionCVE.org
QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminHotelRoomsBookingController::postProcess() that allows restricted back-office employees to access other hotels' data by supplying an id_hotel parameter. Attackers can modify the id_hotel URL parameter on the Book Now page to view room availability and booking status of hotels outside their assigned profile access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB