A vulnerability was identified in jaychouchannel Tourism-Management-System up to 229956e20dbd4a80eeff14535e44d3099502af09. (CVE-2026-90523)
A vulnerability was identified in jaychouchannel Tourism-Management-System up to 229956e20dbd4a80eeff14535e44d3099502af09. The affected element is an unknown function of the file travel/src/main/java/com/controller/UsersController.java of the component User Register Endpoint. Such manipulation of the argument UsersEntity leads to improper privilege management. The attack can be launched remotely. The exploit is publicly available and might be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The name of the patch is 84d8ec384f669df3985293dab293bb7b477efa64. Applying a patch is advised to resolve this issue.
AI Analysis
Technical Summary
CVE-2026-90523 describes a vulnerability in the jaychouchannel Tourism-Management-System up to commit 229956e20dbd4a80eeff14535e44d3099502af09. The issue resides in an unknown function of travel/src/main/java/com/controller/UsersController.java, specifically in the User Register Endpoint component. Improper privilege management occurs due to manipulation of the UsersEntity argument, allowing remote attackers to exploit the system without requiring privileges or user interaction. A patch identified by commit 84d8ec384f669df3985293dab293bb7b477efa64 is recommended to fix the vulnerability. No versioning scheme is used, so affected versions cannot be precisely enumerated.
Potential Impact
The vulnerability allows remote attackers to manipulate user registration data leading to improper privilege management, which can result in unauthorized access or privilege escalation. The CVSS score of 7.3 reflects a significant impact on confidentiality, integrity, and availability, though exploitation does not require privileges or user interaction.
Mitigation Recommendations
Applying the patch identified by commit 84d8ec384f669df3985293dab293bb7b477efa64 is advised to resolve this vulnerability. Since the product lacks versioning, ensure the patch is applied to the affected codebase. No additional mitigation guidance is provided.
A vulnerability was identified in jaychouchannel Tourism-Management-System up to 229956e20dbd4a80eeff14535e44d3099502af09. (CVE-2026-90523)
Description
A vulnerability was identified in jaychouchannel Tourism-Management-System up to 229956e20dbd4a80eeff14535e44d3099502af09. The affected element is an unknown function of the file travel/src/main/java/com/controller/UsersController.java of the component User Register Endpoint. Such manipulation of the argument UsersEntity leads to improper privilege management. The attack can be launched remotely. The exploit is publicly available and might be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The name of the patch is 84d8ec384f669df3985293dab293bb7b477efa64. Applying a patch is advised to resolve this issue.
CVSS v3.1
Score 7.3high
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-90523 describes a vulnerability in the jaychouchannel Tourism-Management-System up to commit 229956e20dbd4a80eeff14535e44d3099502af09. The issue resides in an unknown function of travel/src/main/java/com/controller/UsersController.java, specifically in the User Register Endpoint component. Improper privilege management occurs due to manipulation of the UsersEntity argument, allowing remote attackers to exploit the system without requiring privileges or user interaction. A patch identified by commit 84d8ec384f669df3985293dab293bb7b477efa64 is recommended to fix the vulnerability. No versioning scheme is used, so affected versions cannot be precisely enumerated.
Potential Impact
The vulnerability allows remote attackers to manipulate user registration data leading to improper privilege management, which can result in unauthorized access or privilege escalation. The CVSS score of 7.3 reflects a significant impact on confidentiality, integrity, and availability, though exploitation does not require privileges or user interaction.
Mitigation Recommendations
Applying the patch identified by commit 84d8ec384f669df3985293dab293bb7b477efa64 is advised to resolve this vulnerability. Since the product lacks versioning, ensure the patch is applied to the affected codebase. No additional mitigation guidance is provided.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-phcr-xqg5-c575
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-90523"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aa7419e55bf5e2cf5489bb0
Added to database: 09/14/2026, 00:36:46 UTC
Last enriched: 09/14/2026, 00:40:41 UTC
Last updated: 09/14/2026, 03:01:22 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.