CVE-2026-90523: Tourism Management System Privilege Escalation

CVE-2026-90523 Overview

CVE-2026-90523 is an improper privilege management vulnerability [CWE-266] in the jaychouchannel Tourism-Management-System, a Java-based travel booking application. The flaw resides in the UsersController.java file within the User Register Endpoint at travel/src/main/java/com/controller/UsersController.java. Manipulation of the UsersEntity argument allows an unauthenticated remote attacker to alter privilege attributes during account registration. The project does not use versioning, so affected and unaffected releases cannot be enumerated. A public exploit is referenced by the reporter, and a patch identified by commit 84d8ec384f669df3985293dab293bb7b477efa64 is available.

Critical Impact
Remote attackers can register or modify accounts with elevated privileges, undermining access control across the application.

Affected Products

jaychouchannel Tourism-Management-System up to commit 229956e20dbd4a80eeff14535e44d3099502af09
Component: User Register Endpoint (travel/src/main/java/com/controller/UsersController.java)
Related controllers annotated with @IgnoreAuth, including ChatmessageController and DiscussjiudianxinxiController

Discovery Timeline

2026-09-13 - CVE-2026-90523 published to the National Vulnerability Database (NVD)
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90523

Vulnerability Analysis

The Tourism-Management-System exposes controller endpoints that accept a full entity object from the request body without filtering privileged fields. In the User Register Endpoint, an attacker submits a crafted UsersEntity JSON payload that includes role or authority attributes. The framework binds these attributes directly to the persisted entity, granting the attacker elevated privileges upon registration.

Related controllers compound the exposure by using the @IgnoreAuth annotation on state-changing methods such as /update. This annotation removes authentication requirements, letting any remote client modify records they do not own. The patch removes @IgnoreAuth from these update methods, restoring authorization checks.

Root Cause

The root cause is mass assignment of client-supplied entity fields combined with missing authorization enforcement [CWE-266]. Controllers accept @RequestBody objects that contain sensitive fields such as user roles, and update endpoints are explicitly marked to bypass authentication. No server-side filter or role check validates that the requester is permitted to set privileged attributes.

Attack Vector

Exploitation requires only network access to the application. An attacker sends an HTTP POST to the registration endpoint with a JSON body that sets a privileged role field on the UsersEntity. Because the endpoint requires no prior authentication and performs no field-level authorization, the server persists the elevated account. The attacker then authenticates with the new account to access administrative functionality.

java

// Patch excerpt: authorization annotation removed from update endpoints
     */
    @RequestMapping("/update")
    @Transactional
-   @IgnoreAuth
    public R update(@RequestBody ChatmessageEntity chatmessage, HttpServletRequest request){
        //ValidatorUtils.validateEntity(chatmessage);
        chatmessageService.updateById(chatmessage);//全部更新

// A parallel change was applied to DiscussjiudianxinxiController.java
     */
    @RequestMapping("/update")
    @Transactional
-   @IgnoreAuth
    public R update(@RequestBody DiscussjiudianxinxiEntity discussjiudianxinxi, HttpServletRequest request){
        //ValidatorUtils.validateEntity(discussjiudianxinxi);
        discussjiudianxinxiService.updateById(discussjiudianxinxi);//全部更新

Source: GitHub Commit 84d8ec3

Detection Methods for CVE-2026-90523

Indicators of Compromise

POST requests to the user registration endpoint containing role, authority, or admin-related fields in the JSON body
Newly created accounts holding administrative roles that were not provisioned by an authorized administrator
Requests to /update handlers on controllers such as ChatmessageController or DiscussjiudianxinxiController from unauthenticated sessions

Detection Strategies

Review application access logs for registration or update requests originating from unauthenticated clients that modify privileged database records
Enable audit logging on user account tables and alert on role changes that occur outside administrator sessions
Add a web application firewall rule to inspect JSON request bodies for role-elevation fields on public registration endpoints

Monitoring Recommendations

Baseline the volume of registration and update calls, and alert on statistically significant spikes
Correlate account creation events with subsequent privileged actions performed by the same account within a short window
Track deployments against the upstream repository to identify hosts still running commits prior to 84d8ec384f669df3985293dab293bb7b477efa64

How to Mitigate CVE-2026-90523

Immediate Actions Required

Apply the upstream patch commit 84d8ec384f669df3985293dab293bb7b477efa64 from the Tourism-Management-System repository
Audit existing user accounts for unauthorized privilege assignments and revoke or reset any accounts created since deployment
Restrict network exposure of the application to trusted networks until the patch is deployed and verified

Patch Information

The maintainer published the fix in commit 84d8ec384f669df3985293dab293bb7b477efa64, which removes the @IgnoreAuth annotation from sensitive /update endpoints and addresses related authorization issues tracked in GitHub Issue #10. Because the project does not publish versioned releases, operators must rebuild from the patched source. Additional context is available on the VulDB advisory.

Workarounds

Add a reverse-proxy filter that strips role, authority, and admin fields from JSON bodies sent to the registration endpoint
Require authenticated administrator sessions for any endpoint that persists changes to user or configuration entities
Introduce a server-side allow list of fields accepted by @RequestBody binding on the UsersEntity object

bash

# Example NGINX rule to block role-elevation attempts against the registration endpoint
location /users/register {
    if ($request_body ~* "\"role\"\s*:\s*\"?(admin|1|100)\"?") {
        return 403;
    }
    proxy_pass http://tourism_backend;
}