CVE-2026-90523
- Source
- https://cve.org/CVERecord?id=CVE-2026-90523
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90523.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-90523
- Published
- 2026-09-13T13:15:18Z
- Modified
- 2026-10-21T10:48:51Z
- Severity
-
- 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
- Summary
- jaychouchannel Tourism-Management-System User Register Endpoint UsersController.java privileges management
- Details
-
A vulnerability was identified in jaychouchannel Tourism-Management-System up to 229956e20dbd4a80eeff14535e44d3099502af09. The affected element is an unknown function of the file travel/src/main/java/com/controller/UsersController.java of the component User Register Endpoint. Such manipulation of the argument UsersEntity leads to improper privilege management. The attack can be launched remotely. The exploit is publicly available and might be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The name of the patch is 84d8ec384f669df3985293dab293bb7b477efa64. Applying a patch is advised to resolve this issue.
- Database specific
{ "cna_assigner": "VulDB", "cwe_ids": [ "CWE-266", "CWE-269" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90523.json" }- References
-
- https://github.com/jaychouchannel/Tourism-Management-System/
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90523.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-90523
- https://vuldb.com/cve/CVE-2026-90523
- https://vuldb.com/submit/912244
- https://vuldb.com/vuln/403113
- https://github.com/jaychouchannel/Tourism-Management-System/issues/10
- https://vuldb.com/vuln/403113/cti
- https://github.com/jaychouchannel/Tourism-Management-System/commit/84d8ec384f669df3985293dab293bb7b477efa64
Affected packages
Git / github.com/jaychouchannel/tourism-management-system
Affected ranges
- Type
- GIT
- Repo
- https://github.com/jaychouchannel/tourism-management-system
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "229956e20dbd4a80eeff14535e44d3099502af09" }, { "last_affected": "229956e20dbd4a80eeff14535e44d3099502af09" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "fixed": "84d8ec384f669df3985293dab293bb7b477efa64" } ], "source": "REFERENCES_COMMIT" } ] }
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90523.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"41014553720754747213129855517079154014",
"1510151887905267182586449104041252304",
"32757541173665388847623920277695892305",
"9798368509815479234805798222265973109"
],
"threshold": 0.9
},
"id": "CVE-2026-90523-08801a55",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/jaychouchannel/tourism-management-system/commit/84d8ec384f669df3985293dab293bb7b477efa64",
"target": {
"file": "travel/src/main/java/com/controller/DiscussjiudianxinxiController.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"41014553720754747213129855517079154014",
"89938220429199192656914482516976385743",
"148810940127412544954149649065053266805",
"30810971176066771867478194652797185409"
],
"threshold": 0.9
},
"id": "CVE-2026-90523-19740fbc",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/jaychouchannel/tourism-management-system/commit/84d8ec384f669df3985293dab293bb7b477efa64",
"target": {
"file": "travel/src/main/java/com/controller/DiscussmeishicantingController.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"41014553720754747213129855517079154014",
"47213905344086985607609986214449526003",
"41392102217314572388621331186083189797",
"41253932149451308084898503485910501272"
],
"threshold": 0.9
},
"id": "CVE-2026-90523-1fe342e3",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/jaychouchannel/tourism-management-system/commit/84d8ec384f669df3985293dab293bb7b477efa64",
"target": {
"file": "travel/src/main/java/com/controller/ChatmessageController.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"41014553720754747213129855517079154014",
"5888259048988515772633030959069654917",
"331206065680908644802675225517007000855",
"129028748044122831172469056755907819977"
],
"threshold": 0.9
},
"id": "CVE-2026-90523-2000f794",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/jaychouchannel/tourism-management-system/commit/84d8ec384f669df3985293dab293bb7b477efa64",
"target": {
"file": "travel/src/main/java/com/controller/NewsController.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"41014553720754747213129855517079154014",
"52792056692044045623281384391902652316",
"324138563088908210866286047923657712488",
"297864360182968128797753560039442195560"
],
"threshold": 0.9
},
"id": "CVE-2026-90523-2624631b",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/jaychouchannel/tourism-management-system/commit/84d8ec384f669df3985293dab293bb7b477efa64",
"target": {
"file": "travel/src/main/java/com/controller/ForumController.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"41014553720754747213129855517079154014",
"155049830096092638856858619696698220490",
"330112123056670866025545205572688884505",
"124917280261373170884636583508298656157"
],
"threshold": 0.9
},
"id": "CVE-2026-90523-622f4735",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/jaychouchannel/tourism-management-system/commit/84d8ec384f669df3985293dab293bb7b477efa64",
"target": {
"file": "travel/src/main/java/com/controller/DiscusslvyouxianluController.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"41014553720754747213129855517079154014",
"181038890164368042186317456637895765488",
"241553076833333702740789413235319981365",
"116734030885873626903271640405150486742"
],
"threshold": 0.9
},
"id": "CVE-2026-90523-6399d304",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/jaychouchannel/tourism-management-system/commit/84d8ec384f669df3985293dab293bb7b477efa64",
"target": {
"file": "travel/src/main/java/com/controller/FriendlinkController.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"41014553720754747213129855517079154014",
"292334798979686848413755533362104937074",
"82283210252753032525804081122158862605",
"7369570383216483976072195443537923351"
],
"threshold": 0.9
},
"id": "CVE-2026-90523-74f7c453",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/jaychouchannel/tourism-management-system/commit/84d8ec384f669df3985293dab293bb7b477efa64",
"target": {
"file": "travel/src/main/java/com/controller/DiscusslvyougonglveController.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"41014553720754747213129855517079154014",
"268303945667469126851112290290872473171",
"74833693908912451796624515882475819057",
"120313840309549630133159743963795786361"
],
"threshold": 0.9
},
"id": "CVE-2026-90523-7bf611ad",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/jaychouchannel/tourism-management-system/commit/84d8ec384f669df3985293dab293bb7b477efa64",
"target": {
"file": "travel/src/main/java/com/controller/DiscussremenjingdianController.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"41014553720754747213129855517079154014",
"78335271404540812404418968451016504332",
"22620790659802622079449933228002518345",
"252191504866874412576432720326686549441"
],
"threshold": 0.9
},
"id": "CVE-2026-90523-8c4f5404",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/jaychouchannel/tourism-management-system/commit/84d8ec384f669df3985293dab293bb7b477efa64",
"target": {
"file": "travel/src/main/java/com/controller/NewstypeController.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"41014553720754747213129855517079154014",
"14436421123829602486048568932635765957",
"168696206330163481169630788586065991179",
"70717625996343693951956437341469379515"
],
"threshold": 0.9
},
"id": "CVE-2026-90523-b40ed19a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/jaychouchannel/tourism-management-system/commit/84d8ec384f669df3985293dab293bb7b477efa64",
"target": {
"file": "travel/src/main/java/com/controller/StoreupController.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"41014553720754747213129855517079154014",
"17193502332962202147348428669050213487",
"224122339849933588359841807212981618537",
"162727424050264276382208977803128928716"
],
"threshold": 0.9
},
"id": "CVE-2026-90523-bb7b8e53",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/jaychouchannel/tourism-management-system/commit/84d8ec384f669df3985293dab293bb7b477efa64",
"target": {
"file": "travel/src/main/java/com/controller/FriendController.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "248032252367280849326557361905560872022",
"length": 1631
},
"id": "CVE-2026-90523-d06d61f5",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/jaychouchannel/tourism-management-system/commit/84d8ec384f669df3985293dab293bb7b477efa64",
"target": {
"file": "travel/src/main/java/com/interceptor/AuthorizationInterceptor.java",
"function": "preHandle"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"182666167043646849483842404685895899107",
"175819716304157808468298993203143512541",
"114575701617552473567112502710136505145",
"130827707540499110167079773872905566513",
"193945555105656936453847297800470789796",
"183325986263730029783145769233746546977"
],
"threshold": 0.9
},
"id": "CVE-2026-90523-ec46ea20",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/jaychouchannel/tourism-management-system/commit/84d8ec384f669df3985293dab293bb7b477efa64",
"target": {
"file": "travel/src/main/java/com/interceptor/AuthorizationInterceptor.java"
}
}
]
vanir_signatures_modified
"2026-10-21T10:48:51Z"