CVE-2026-105836

QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminProductsController::ajaxProcessBulkUpdateRooms that allows hotel-restricted back-office employees to modify rooms of other hotels. Attackers can submit foreign room IDs in the id rooms parameter to change status, floor, comments, or inactive dates, disrupting availability and bookings.