QloApps up to version 1.7.0 contains an authorization bypass (CWE‑639) in the ajaxProcessBulkUpdateRooms method of the AdminProductsController. The flaw allows users with back‑office privileges tied to one hotel to supply foreign room identifiers and change critical properties—status, floor, comments, or inactive dates—of rooms that belong to other hotels. This can result in inaccurate availability information and unintentional booking cancellations, effectively disrupting hotel operations and revenue.

The vulnerability affects the Webkul QloApps e‑commerce solution on all releases through version 1.7.0. Any deployment that has not been patched beyond 1.7.0 is susceptible.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is currently not available, so the likelihood of large‑scale exploitation cannot be quantified. This issue is not listed in the CISA KEV catalog. Exploitation requires an authenticated back‑office employee or compromise of such credentials, so the attack vector is internal or credential‑based. If an attacker gains access to a hotel‑restricted employee account, they can modify foreign rooms with little to no detection, potentially causing data integrity and availability problems.