CVE-2026-90524
Received Received - Intake

Authentication Bypass in Jaychouchannel Tourism-Management-System

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: VulDB

Description
A security flaw has been discovered in jaychouchannel Tourism-Management-System up to 229956e20dbd4a80eeff14535e44d3099502af09. The impacted element is an unknown function of the component Update Endpoint. Performing a manipulation results in missing authentication. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The patch is named 84d8ec384f669df3985293dab293bb7b477efa64. It is suggested to install a patch to address this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-13
Last Modified
2026-09-13
Generated
2026-09-13
AI Q&A
2026-09-13
EPSS Evaluated
N/A
NVD
CVE-2026-90524
EUVD
EUVD-2026-77022

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
jaychouchannel tourism-management-system to 229956e20dbd4a80eeff14535e44d3099502af09 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-90524 is a security flaw in the Tourism-Management-System where unauthenticated endpoints allow arbitrary record modification. The system exposes multiple controllers with an unauthenticated /update endpoint that accepts client data and passes it to an updateById method, enabling unauthorized changes.

Detection Guidance

Check for unauthenticated endpoints in the Tourism-Management-System by inspecting network traffic for requests to /update endpoints. Look for controllers like ForumController, ChatmessageController, or StoreupController handling updates without authentication. Review server logs for unusual modification requests to records such as forum posts, comments, or private chats.

Impact Analysis

An attacker could exploit this to deface forum and news content, alter comments, links, favorites, friendships, and private chat records. It also enables stored cross-site scripting (XSS) attacks, potentially compromising user data and system integrity.

Mitigation Strategies

Apply the patch named 84d8ec384f669df3985293dab293bb7b477efa64 immediately. Disable or restrict access to the unauthenticated /update endpoints in affected controllers. Implement authentication checks for all update operations. Monitor system logs for suspicious activity targeting these endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90524. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart