Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-90520: jaychouchannel Tourism Management System allows unauthorized access

CVE-2026-90520 · published 1 month ago

Summary

A part of the jaychouchannel Tourism Management System that checks user permissions does not work correctly, letting attackers act as if they were authorized. This can be triggered from outside the network, so an attacker could perform actions they should not be allowed to do. Install the supplied patch (identified as d984d172dceca907f8b447efbdb06dc233f7938d) to fix the problem.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
jaychouchannel	tourism-management-system	84d8ec384f669df3985293dab293bb7b477efa64

Original advisory text

jaychouchannel Tourism-Management-System Authorization Interceptor AuthorizationInterceptor.java improper authorization

A vulnerability has been found in jaychouchannel Tourism-Management-System up to 84d8ec384f669df3985293dab293bb7b477efa64. This vulnerability affects unknown code of the file AuthorizationInterceptor.java of the component Authorization Interceptor. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The identifier of the patch is d984d172dceca907f8b447efbdb06dc233f7938d. Applying a patch is the recommended action to fix this issue.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-90520 Vendor Advisory
https://vuldb.com/vuln/403110/cti Third Party Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90520... Vendor Advisory
https://github.com/jaychouchannel/Tourism-Management-System/commit/d984d172dceca... Patch
https://vuldb.com/cve/CVE-2026-90520 Vendor Advisory
https://vuldb.com/submit/912234 Vendor Advisory
https://vuldb.com/vuln/403110 Vendor Advisory
https://github.com/jaychouchannel/Tourism-Management-System/issues/12 Third Party Advisory
https://github.com/jaychouchannel/Tourism-Management-System/ URL

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

7.9 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-285Improper Authorization

CWE-266Incorrect Privilege Assignment

Timeline

Published13 Sep 2026

Updated4 Nov 2026

First seen13 Sep 2026

Sources

CVE-2026-90520 · NVD

CVE-2026-90520 · MITRE

CVE-2026-90520 · OSV

Track software like this

Free during beta