CVE-2026-105836— QloApps through 1.7.0 Authorization Bypass via ajaxProcessBulkUpdateRooms
Quick assessment
Affected
Webkul QloApps
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
QloApps 版本 1.7.0 及之前版本中存在一个授权绕过漏洞，位于 AdminProductsController::ajaxProcessBulkUpdateRooms 方法中。该漏洞允许受酒店访问限制的后端办公员工修改其他酒店的房间信息。攻击者可以通过在 id_rooms 参数中提交非本酒店的房间 ID，更改房间状态、楼层、备注或停用日期，从而破坏房间可用性和预订数据。
Possible ATT&CK Techniques 1 AI
T1078 · Valid Accounts
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-105836
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
QloApps through 1.7.0 Authorization Bypass via ajaxProcessBulkUpdateRooms
Source: CVE Program / CVE List V5
Vulnerability Description
QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminProductsController::ajaxProcessBulkUpdateRooms that allows hotel-restricted back-office employees to modify rooms of other hotels. Attackers can submit foreign room IDs in the id_rooms parameter to change status, floor, comments, or inactive dates, disrupting availability and bookings.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-105836
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-105836
请登录查看更多情报信息。
Other References for CVE-2026-105836 (4)
-
https://hackmd.io/@leediay/H189W20qfg technical-description
-
IV. Related Vulnerabilities
Same product: QloApps
-
CVE-2026-103590
QloApps through 1.7.0 Reflected XSS via Length of Stay Field -
CVE-2026-103589
QloApps through 1.7.0 Reflected XSS via Room Type Editor -
CVE-2026-103588
QloApps through 1.7.0 Reflected XSS via exceptions field -
CVE-2026-103587
QloApps through 1.7.0 Reflected XSS via Book Now Search Para -
CVE-2026-93988
QloApps through 1.7.0 Arbitrary File Read via getEmailHTML
Same vendor: Webkul
-
CVE-2026-103590
QloApps through 1.7.0 Reflected XSS via Length of Stay Field -
CVE-2026-103588
QloApps through 1.7.0 Reflected XSS via exceptions field -
CVE-2026-103589
QloApps through 1.7.0 Reflected XSS via Room Type Editor -
CVE-2026-103587
QloApps through 1.7.0 Reflected XSS via Book Now Search Para -
CVE-2026-101139
Webkul Bagisto Invoice Mass Status Update state authorizatio
Same weakness: CWE-639
-
CVE-2026-87975
Privilege abuse in model formsets with editable primary keys -
CVE-2026-39756
WordPress Wappointment plugin <= 2.7.7 - Insecure Direct Obj -
CVE-2026-32576
WordPress Faktur Pro for WooCommerce plugin <= 3.2.1 - Insec -
CVE-2026-105572
PickMall Lilishop Buyer Invoice List receipt authorization -
CVE-2026-105761
Dify: IDOR in AppMCPServer PUT Endpoint Allows Modification
V. Comments for CVE-2026-105836
No comments yet