CVE-2026-90524: Tourism Management System Auth Bypass Flaw

CVE-2026-90524 Overview

CVE-2026-90524 is a missing authentication vulnerability [CWE-287] in the jaychouchannel Tourism-Management-System project. The flaw affects an update endpoint that accepts modifications without verifying caller identity. The project uses a rolling release model, so no discrete version numbers are published for affected or fixed builds. Affected code exists up to commit 229956e20dbd4a80eeff14535e44d3099502af09, and the patch is tracked under commit 84d8ec384f669df3985293dab293bb7b477efa64. The exploit is public and can be initiated remotely across the network without user interaction.

Critical Impact

Unauthenticated remote attackers can invoke /update controller endpoints to modify chat messages and hotel discussion records without authorization.

Affected Products

• jaychouchannel Tourism-Management-System (rolling release)
• Source code up to commit 229956e20dbd4a80eeff14535e44d3099502af09
• ChatmessageController and DiscussjiudianxinxiController update endpoints

Discovery Timeline

• 2026-09-13 - CVE-2026-90524 published to NVD
• 2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-90524

Vulnerability Analysis

The vulnerability resides in Spring MVC controllers exposed by the Tourism-Management-System web application. Multiple /update endpoints are annotated with @IgnoreAuth, which bypasses the framework's authentication filter. Any remote client can send a crafted POST request that mutates database records via updateById. The impacted controllers include ChatmessageController and DiscussjiudianxinxiController, both of which persist attacker-controlled entity payloads without validating the requester's session or role.

Root Cause

The root cause is improper authentication [CWE-287]. Developers applied the @IgnoreAuth annotation to update handlers that should require an authenticated session. The commented-out ValidatorUtils.validateEntity call further indicates that input validation was disabled. Together, these choices expose write operations to anonymous callers on the network.

Attack Vector

Exploitation requires only network reachability to the application. An attacker sends a JSON body matching the target entity schema to /chatmessage/update or /discussjiudianxinxi/update. The controller deserializes the payload and invokes the service layer to overwrite the corresponding row. No credentials, tokens, or CSRF material are required.

     */
    @RequestMapping("/update")
    @Transactional
-   @IgnoreAuth
    public R update(@RequestBody ChatmessageEntity chatmessage, HttpServletRequest request){
        //ValidatorUtils.validateEntity(chatmessage);
        chatmessageService.updateById(chatmessage);//全部更新

Source: GitHub Commit 84d8ec38 — the patch removes @IgnoreAuth from the vulnerable update handlers, restoring authentication enforcement.

Detection Methods for CVE-2026-90524

Indicators of Compromise

• Unauthenticated POST requests to /chatmessage/update or /discussjiudianxinxi/update paths in web server access logs.
• Database rows in chat message or hotel discussion tables with unexpected timestamps or content modifications.
• Requests to /update endpoints lacking session cookies or authorization headers.

Detection Strategies

• Perform static analysis of Spring controllers for the @IgnoreAuth annotation on state-changing handlers.
• Enable audit logging on updateById service methods to correlate mutations with authenticated identity.
• Deploy a reverse proxy rule that blocks anonymous access to /update route patterns.

Monitoring Recommendations

• Track anomalous write volume to backend tables tied to the affected controllers.
• Alert on HTTP POST responses returning R.ok() for /update paths without a preceding authentication event.
• Review Git history for reintroduction of @IgnoreAuth annotations during code merges.

How to Mitigate CVE-2026-90524

Immediate Actions Required

• Apply commit 84d8ec384f669df3985293dab293bb7b477efa64 to the deployed source tree and rebuild the application.
• Restrict network exposure of the Tourism-Management-System instance to trusted internal networks until patched.
• Audit all controllers for additional occurrences of @IgnoreAuth on write operations and remove them where inappropriate.

Patch Information

The upstream fix is provided in commit 84d8ec384f669df3985293dab293bb7b477efa64 in the jaychouchannel Tourism-Management-System repository. The patch removes the @IgnoreAuth annotation from vulnerable /update handlers, forcing the framework's authentication filter to validate the caller before the update executes. See the GitHub Issue Report and VulDB entry for CVE-2026-90524 for advisory context.

Workarounds

• Place the application behind a reverse proxy that enforces authentication for /update URI patterns.
• Add a servlet filter that rejects requests to affected controllers when no valid session token is present.
• Uncomment and enable ValidatorUtils.validateEntity to reduce the attack surface of the entity payload.

# Nginx snippet to require an upstream auth check before proxying /update endpoints
location ~ ^/(chatmessage|discussjiudianxinxi)/update$ {
    auth_request /_auth;
    proxy_pass http://tms_backend;
}

location = /_auth {
    internal;
    proxy_pass http://auth_service/validate;
    proxy_pass_request_body off;
    proxy_set_header Content-Length "";
    proxy_set_header X-Original-URI $request_uri;
}