CVE-2026-90520: Tourism Management System Auth Bypass Flaw

CVE-2026-90520 Overview

CVE-2026-90520 is an improper authorization vulnerability in the jaychouchannel Tourism-Management-System, affecting the AuthorizationInterceptor.java component. The flaw allows remote attackers with low privileges to bypass authorization checks on specific controller endpoints. The project uses a rolling release model, so no fixed version identifiers are published; the patch commit is d984d172dceca907f8b447efbdb06dc233f7938d. The issue is classified under CWE-266: Incorrect Privilege Assignment. Public disclosure of the exploit technique has occurred, though no weaponized exploit is currently tracked in ExploitDB or the CISA KEV catalog.

Critical Impact

Remote authenticated users can invoke update endpoints annotated with @IgnoreAuth, modifying chat messages and hotel discussion records without appropriate authorization checks.

Affected Products

• jaychouchannel Tourism-Management-System (rolling release up to commit 84d8ec384f669df3985293dab293bb7b477efa64)
• Component: AuthorizationInterceptor.java (Authorization Interceptor)
• Controllers: ChatmessageController.java, DiscussjiudianxinxiController.java

Discovery Timeline

• 2026-09-13 - CVE-2026-90520 published to NVD
• 2026-09-20 - Last updated in NVD database

Technical Details for CVE-2026-90520

Vulnerability Analysis

The vulnerability originates in the authorization enforcement layer of the Tourism-Management-System, a Java Spring-based application. Several controller update endpoints are annotated with @IgnoreAuth, which instructs the AuthorizationInterceptor to bypass authentication and authorization validation. This misconfiguration exposes state-changing operations to any remote caller who can reach the endpoints. Attackers can modify chat messages and hotel discussion records belonging to other users. The flaw maps to CWE-266: Incorrect Privilege Assignment.

Root Cause

The root cause is the incorrect application of the @IgnoreAuth annotation to sensitive update handlers. The annotation was likely applied during development to simplify testing but was not removed before deployment. As a result, the interceptor short-circuits authorization checks on these routes.

Attack Vector

Exploitation requires network access to the application and low-level credentials. An attacker crafts an HTTP POST request to the affected /update endpoints with a JSON body targeting arbitrary record identifiers. Because authorization is skipped, the request succeeds regardless of record ownership.

// Patch: travel/src/main/java/com/controller/ChatmessageController.java
     */
    @RequestMapping("/update")
    @Transactional
-   @IgnoreAuth
    public R update(@RequestBody ChatmessageEntity chatmessage, HttpServletRequest request){
        //ValidatorUtils.validateEntity(chatmessage);
        chatmessageService.updateById(chatmessage);//全部更新

Source: GitHub Commit d984d172

// Patch: travel/src/main/java/com/controller/DiscussjiudianxinxiController.java
     */
    @RequestMapping("/update")
    @Transactional
-   @IgnoreAuth
    public R update(@RequestBody DiscussjiudianxinxiEntity discussjiudianxinxi, HttpServletRequest request){
        //ValidatorUtils.validateEntity(discussjiudianxinxi);
        discussjiudianxinxiService.updateById(discussjiudianxinxi);//全部更新

Source: GitHub Commit d984d172

The patch removes @IgnoreAuth from both update handlers, restoring interceptor-based authorization enforcement.

Detection Methods for CVE-2026-90520

Indicators of Compromise

• Unexpected POST requests to /chatmessage/update or /discussjiudianxinxi/update from low-privileged accounts.
• Database records for chat messages or hotel discussions modified by user IDs that do not own the records.
• Application logs showing successful updateById operations without preceding authorization checks.

Detection Strategies

• Perform a static source code review to enumerate all handlers annotated with @IgnoreAuth and validate each one is intentional.
• Deploy web application firewall (WAF) rules that alert on /update endpoint calls carrying identifiers referencing records owned by other principals.
• Correlate authentication session identifiers with modified record ownership in the database to surface authorization anomalies.

Monitoring Recommendations

• Enable verbose logging in AuthorizationInterceptor.java to record every request that bypasses authorization due to @IgnoreAuth.
• Monitor for anomalous update volumes originating from a single authenticated session.
• Track HTTP 200 responses on state-changing endpoints from newly created or low-reputation accounts.

How to Mitigate CVE-2026-90520

Immediate Actions Required

• Pull the latest revision of the Tourism-Management-System repository containing patch commit d984d172dceca907f8b447efbdb06dc233f7938d.
• Audit all controllers in the com.controller package for lingering @IgnoreAuth annotations on non-public endpoints.
• Restrict network exposure of the application until the patched code is deployed.

Patch Information

The upstream fix is available via commit d984d172, merged from pull request #16. The patch removes @IgnoreAuth from the update handlers in ChatmessageController.java and DiscussjiudianxinxiController.java, forcing requests through the standard authorization pipeline. Additional context is available in the VulDB entry for CVE-2026-90520 and GitHub Issue #12.

Workarounds

• Add reverse-proxy access control lists that require authenticated sessions with proper role claims for all /update routes.
• Introduce an application-level filter that rejects requests to state-changing endpoints when the session user does not own the target record.
• Temporarily disable the affected chat message and hotel discussion update features until the patch is applied.

# Example nginx rule restricting /update endpoints to internal networks
location ~ ^/(chatmessage|discussjiudianxinxi)/update$ {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://tourism_backend;
}