CVE-2026-90521
Received Received - Intake

Authorization Bypass in Tourism Management System

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: VulDB

Description
A vulnerability was found in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132. This issue affects some unknown processing of the file MenpiaodingdanController.java of the component CRUD. The manipulation of the argument ID results in authorization bypass. It is possible to launch the attack remotely. The exploit has been made public and could be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The patch is identified as d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86. It is best practice to apply a patch to resolve this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-13
Last Modified
2026-09-13
Generated
2026-09-13
AI Q&A
2026-09-13
EPSS Evaluated
N/A
NVD
CVE-2026-90521
EUVD
EUVD-2026-77012

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
jaychouchannel tourism_management_system to 8122bf020d91199eddfff3ee02d1632a70a9a132 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization bypass in the Tourism-Management-System. It allows remote attackers to manipulate the ID argument in the MenpiaodingdanController.java file to access or modify data without proper permissions. The exploit enables unauthorized changes to other users' records, including profiles, orders, and reservations.

Detection Guidance

To detect this vulnerability, inspect the MenpiaodingdanController.java file in the Tourism-Management-System for authorization checks on the ID argument. Look for missing or improper validation of user permissions when handling update operations. Check if the system allows direct object references without proper session or role-based access control.

Impact Analysis

If exploited, this vulnerability could allow attackers to view, modify, or delete your personal data, such as booking details or profile information. It may also enable them to perform actions on your behalf, leading to financial loss or privacy breaches. The exploit is publicly available, increasing the risk of real-world attacks.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized data access and potential exposure of personal information. GDPR requires strict data protection and user consent, while HIPAA mandates safeguards for sensitive health-related data. The breach could result in legal penalties and reputational damage for organizations using this system.

Mitigation Strategies

Apply the patch identified as d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86 to the Tourism-Management-System. Ensure all endpoints, especially those handling user data updates, enforce strict authorization checks. Validate user ownership of records before allowing modifications. Review and restrict direct object references in API requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90521. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart