QloApps 1.7.0 contains a broken access control flaw that allows back‑office users with hotel‑restricted access to create new room types for any hotel by supplying an arbitrary id_hotel value. By manipulating the id_hotel field in AdminProductsController and the HotelBranchInformation module, an attacker can add rooms, inventories, and other settings to hotels they are not authorized to manage. This can result in unauthorized data modification, inventory misconfiguration, and potential revenue loss for the affected hotels.

Vendor: Webkul QloApps. Affected Version: 1.7.0. No additional version specifics are provided. Only this release is known to be vulnerable.

The CVSS score is 5.3 and the EPSS score is not available, indicating a moderate severity with an undefined exploitation probability. The vulnerability requires an authenticated back‑office session, and the attacker only needs to possess a hotel‑restricted role. The flaw can be exploited through the administrative product creation interface by sending a crafted POST request containing a foreign hotel identifier. Because the attack does not grant arbitrary system access but allows creation of data under other hotels, the risk is mainly confined to data integrity and availability within those hotel records. It is not currently listed in the CISA KEV catalog.