The QloApps application up to version 1.7.0 is vulnerable to an insecure direct object reference caused by missing hotel-level access checks in several back‑office Ajax handlers. The flaw allows an employee who belongs to a specific hotel to craft requests that reference other hotels' identifiers, thereby reading, uploading, and deleting booking documents, rooms, and images belonging to those hotels. This exposes confidential booking data, permits unauthorized file manipulation, and can lead to data loss or exposure of sensitive information.

The vulnerability affects Webkul's QloApps up to and including version 1.7.0. Specifically the back‑office modules AdminOrdersController, AdminBookingDocumentController, AdminProductsController and AdminAddHotelController contain the oversight in their Ajax handlers. Organisations using these modules and employing hotel‑restricted staff are at risk.

The CVSS base score of 5.3 indicates moderate severity. The Exploit Prediction Scoring System is not available, so no current evidence of exploitation is documented. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires an authenticated session in the back‑office; an attacker with hotel‑restricted credentials can issue Ajax requests to target hotel identifiers. While no public exploits are known, the IDOR can be abused by internal actors or compromised users to read and alter unrelated hotel data.