This vulnerability is an improper access control flaw that allows hotel‑restricted back‑office employees to view credit slips from hotels other than their own. By exploiting the AdminSlipController, a malicious user can list all credit slips, export them as PDF, mark them as redeemed, and create store‑credit vouchers for refund records of other hotels. This exposes customer personal information, refund amounts, and enables fraudulent voucher creation, representing a breach of confidentiality and potential financial loss.

The affected product is Webkul QloApps, all releases up to and including version 1.7.0. The flaw resides in the "AdminSlipController" component of this hotel‑management system, and any environment running these versions is susceptible.

The CVSS score of 5.3 indicates a medium severity. The EPSS score is below 1%, indicating a very low but nonzero probability of exploitation, and the vulnerability is not listed in CISA KEV, suggesting no confirmed public exploits yet. The likely attack vector is a legitimate back‑office login; an attacker requires valid credentials for a hotel‑restricted admin role and can then navigate to the credit‑slip interface to retrieve data across all hotels. Because the flaw removes an intended access boundary, it can be used repeatedly to harvest sensitive information and create unauthorized vouchers, making it a significant risk if left unmitigated.