CVE-2026-90520
Received Received - Intake

Improper Authorization in Tourism-Management-System

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: VulDB

Description
A vulnerability has been found in jaychouchannel Tourism-Management-System up to 84d8ec384f669df3985293dab293bb7b477efa64. This vulnerability affects unknown code of the file AuthorizationInterceptor.java of the component Authorization Interceptor. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The identifier of the patch is d984d172dceca907f8b447efbdb06dc233f7938d. Applying a patch is the recommended action to fix this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-13
Last Modified
2026-09-13
Generated
2026-09-13
AI Q&A
2026-09-13
EPSS Evaluated
N/A
NVD
CVE-2026-90520
EUVD
EUVD-2026-77011

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
jaychouchannel tourism_management_system to 84d8ec384f669df3985293dab293bb7b477efa64 (inc)
jaychouchannel tourism-management-system to 84d8ec384f669df3985293dab293bb7b477efa64 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an improper authorization issue in the Tourism-Management-System. It allows unauthorized users to perform update operations due to a bypass mechanism in the code. Specifically, the @IgnoreAuth annotation was removed from multiple controller update methods to enforce proper authorization checks.

Detection Guidance

Check for the presence of the @IgnoreAuth annotation in Java controller files, particularly in AuthorizationInterceptor.java and update methods of controllers like ChatmessageController, DiscussjiudianxinxiController, and others mentioned in the patch. Review API endpoints for improper authorization checks by examining session attributes and role validation logic in UsersController.java and related files.

Impact Analysis

An attacker with a low-privileged user token can exploit this to access, modify, or delete administrative data, including usernames and passwords. This could lead to unauthorized changes, data breaches, or loss of sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized access and modification of sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Non-compliance may result in legal penalties and reputational damage.

Mitigation Strategies

Apply the patch identified by commit d984d172dceca907f8b447efbdb06dc233f7938d to remove the @IgnoreAuth annotation from affected controllers. Ensure proper role-based access control is enforced in AuthorizationInterceptor.java and validate user permissions before granting access to sensitive API endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90520. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart