CVE-2026-90521: Tourism Management System Auth Bypass Flaw

CVE-2026-90521 Overview

CVE-2026-90521 is an authorization bypass vulnerability [CWE-285] in the jaychouchannel/Tourism-Management-System project on GitHub. The flaw resides in the MenpiaodingdanController.java file within the application's CRUD component. An attacker can manipulate the ID argument to bypass authorization checks and access or modify records belonging to other users. The issue affects the project up to commit 8122bf020d91199eddfff3ee02d1632a70a9a132, and the project uses a rolling-release model without versioned releases. The exploit has been publicly disclosed and the maintainer has published a corrective patch identified as d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86.

Critical Impact
Remote authenticated attackers can bypass object-level authorization to read, modify, or delete ticket-order records belonging to other users through direct manipulation of the ID parameter.

Affected Products

jaychouchannel Tourism-Management-System (rolling release)
Commit range up to 8122bf020d91199eddfff3ee02d1632a70a9a132
Component: MenpiaodingdanController.java (CRUD endpoints)

Discovery Timeline

2026-09-13 - CVE-2026-90521 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90521

Vulnerability Analysis

The vulnerability is a broken object-level authorization flaw in the ticket-order controller MenpiaodingdanController.java. CRUD endpoints accept an ID request parameter that references a target record but do not verify that the record belongs to the authenticated caller. As a result, an authenticated user can substitute another user's record identifier and operate on data they are not entitled to access. Because the endpoint is reachable over the network and requires only low-privileged credentials, the attack can be scripted at scale against exposed instances.

A related patch in the same pull request confirms the pattern: the resetPass endpoint in UsersController.java previously carried the @IgnoreAuth annotation and reset any account's password to a hardcoded value. The fix enforces session ownership before mutating state, mirroring the correction required for the ID-driven CRUD paths.

Root Cause

The controller trusts client-supplied identifiers without cross-checking them against the session principal. There is no server-side ownership predicate applied to database lookups, and access-control annotations were either missing or bypassed. This is a canonical Insecure Direct Object Reference (IDOR) pattern classified under [CWE-285: Improper Authorization].

Attack Vector

An attacker authenticates to the application with any low-privileged account, then enumerates or guesses numeric record identifiers and issues CRUD requests through the vulnerable controller. Because the server returns or mutates the target record without validating ownership, cross-tenant data disclosure and tampering are possible. No user interaction is required beyond the attacker's own session.

java

// Security patch excerpt from UsersController.java (same PR #14) demonstrating
// the ownership-check pattern the fix introduces across affected controllers.
// Source: https://github.com/jaychouchannel/Tourism-Management-System/commit/d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86

// - @IgnoreAuth
  @RequestMapping(value = "/resetPass")
  public R resetPass(String username, HttpServletRequest request){
+     Long userId = (Long) request.getSession().getAttribute("userId");
+     if (userId == null) {
+         return R.error(401, "请先登录");
+     }
+     String currentUsername = (String) request.getSession().getAttribute("username");
+     if (!username.equals(currentUsername)) {
+         return R.error("只能重置本人密码");
+     }
      UsersEntity user = userService.selectOne(
          new EntityWrapper<UsersEntity>().eq("username", username));
      if(user==null) {
          return R.error("账号不存在");
      }
-     user.setPassword("123456");
-     userService.update(user,null);
+     String newPassword = java.util.UUID.randomUUID().toString().substring(0, 8);
+     user.setPassword(newPassword);
+     userService.updateById(user);
      return R.ok("密码已重置");
  }

Detection Methods for CVE-2026-90521

Indicators of Compromise

Sequential or non-sequential enumeration of the ID parameter across MenpiaodingdanController endpoints from a single authenticated session.
HTTP responses returning ticket-order records whose owner field does not match the requesting session's username.
Repeated POST/GET requests to CRUD paths with rapidly incrementing numeric identifiers.

Detection Strategies

Add server-side logging that records sessionUserId alongside the ID argument for every CRUD call, then alert when the two do not resolve to the same owner.
Correlate application access logs with database audit trails to surface cross-account read or update operations.
Deploy authenticated dynamic application security testing (DAST) that fuzzes ID parameters between two low-privileged test accounts to reproduce the bypass.

Monitoring Recommendations

Baseline normal per-user access volume to the ticket-order endpoints and alert on statistical deviation.
Monitor for HTTP 200 responses to requests where the returned record's owner differs from the session principal.
Track invocations of the legacy /resetPass endpoint, which was also hardened in the same patch.

How to Mitigate CVE-2026-90521

Immediate Actions Required

Pull the latest main branch that includes patch commit d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86 and redeploy the application.
Invalidate active sessions and require re-authentication after upgrading.
Audit ticket-order records for unauthorized modifications since deployment of any vulnerable commit prior to the patch.

Patch Information

The maintainer merged the fix in Pull Request #14, delivered as commit d44ec3a. The patch introduces a SqlIdentifierValidator utility and enforces session-based ownership checks in affected controllers. Because the project ships as a rolling release, downstream deployments must rebuild from source at or after the patch commit. Additional context is available in GitHub Issue #9 and the VulDB entry for CVE-2026-90521.

Workarounds

Restrict access to the application to trusted internal networks until the patched build is deployed.
Add a reverse-proxy rule that rejects requests to MenpiaodingdanController paths from unauthenticated sessions.
Temporarily disable the ticket-order CRUD endpoints if they are not required for production operation.

bash

# Rebuild from the patched commit
git clone https://github.com/jaychouchannel/Tourism-Management-System.git
cd Tourism-Management-System
git checkout d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86
mvn -f travel/pom.xml clean package -DskipTests

# Verify the patch is present
git log --oneline | grep d44ec3a