{"metadata": {"vulnerability": "CVE-2026-110226", "count": 14, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-01-16T00:00:00Z", "date_only": false, "value": "2026-01-16T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-110226", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-13T17:59:45.437Z", "date_only": false, "value": "2026-10-13T17:59:45.437Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-110226", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-13T18:50:11.477Z", "date_only": false, "value": "2026-10-13T18:50:11.477Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-110226", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-13T18:50:11.477Z", "date_only": false, "value": "2026-10-13T18:50:11.477Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-110226", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-13T19:18:47Z", "date_only": false, "value": "2026-10-13T19:18:47Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-4PJR-6WP6-X63V", "record": "GHSA-4PJR-6WP6-X63V", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-13T19:18:47.390Z", "date_only": false, "value": "2026-10-13T19:18:47.390", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110226", "record": "FKIE_CVE-2026-110226", "field": "published"}, {"timestamp": "2026-10-13T19:19:41.576Z", "date_only": false, "value": "2026-10-13T19:19:41.576004Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117435215412994955", "record": "CVE-2026-110226", "field": "creation_timestamp", "uuid": "e4b711dc-75e5-47f9-91b4-103873b32480", "content": "CVE-2026-110226 QloApps through 1.7.0 Authorization Bypass via id_hotel in Room Type Creation QloApps through 1.7.0 contains a broken access control vulnerability that allows hotel-restricted back-office employees to create room types under unassigned hotels by supplying an arbitrary id_hotel. Attackers can enumerate all hotels via the unfiltered room type form selector and post foreign hotel IDs to AdminProductsController, creating rooms and inventory under other hotels.\nhttps://www.cve.org/CVERecord?id=CVE-2026-110226https://hackmd.io/@leediay/SyMoELioMxhttps://github.com/Qloapps/QloApps/blob/v1.7.0/controllers/admin/AdminProductsController.php#L3038-L3052https://github.com/Qloapps/QloApps/blob/v1.7.0/controllers/admin/AdminProductsController.php#L2362-L2367https://github.com/Qloapps/QloApps/blob/v1.7.0/modules/hotelreservationsystem/classes/HotelBranchInformation.php#L488-L496https://github.com/Qloapps/QloApps/pull/1649https://github.com/Qloapps/QloApps/commit/24ff5f5e6ba0c7a42c83ce8155b318c3ef8c915dhttps://github.com/Qloapps/QloAppshttps://www.vulncheck.com/advisories/qloapps-through-1.7.0-authorization-bypass-via-id-hotel-in-room-type-creation#Webkul #QloApps#CVE_2026_110226#bot", "url": "https://infosec.exchange/users/cve/statuses/117435215412994955"}, {"timestamp": "2026-10-13T21:33:38Z", "date_only": false, "value": "2026-10-13T21:33:38Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-4PJR-6WP6-X63V", "record": "GHSA-4PJR-6WP6-X63V", "field": "published"}, {"timestamp": "2026-10-13T21:33:38Z", "date_only": false, "value": "2026-10-13T21:33:38Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-4PJR-6WP6-X63V", "record": "GHSA-4PJR-6WP6-X63V", "field": "modified"}, {"timestamp": "2026-10-16T22:32:37.092Z", "date_only": false, "value": "2026-10-16T22:32:37.092953Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-110226", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-16T22:32:37.092Z", "date_only": false, "value": "2026-10-16T22:32:37.092953Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110226", "record": "FKIE_CVE-2026-110226", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-16T22:32:49.105Z", "date_only": false, "value": "2026-10-16T22:32:49.105Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-110226", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-16T22:32:49.105Z", "date_only": false, "value": "2026-10-16T22:32:49.105Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-110226", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T23:17:00.277Z", "date_only": false, "value": "2026-10-16T23:17:00.277", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110226", "record": "FKIE_CVE-2026-110226", "field": "lastModified"}]}