CVE-2026-90520: Improper Authorization in jaychouchannel Tourism-Management-System
CVE-2026-90520 is an improper authorization vulnerability in the jaychouchannel Tourism-Management-System affecting the AuthorizationInterceptor.java component. The flaw allows remote attackers to bypass authorization controls. The product uses a rolling release model, so specific affected versions are not identified. A patch identified by commit d984d172dceca907f8b447efbdb06dc233f7938d is recommended to remediate the issue. The vulnerability has a medium severity with a CVSS 4.0 score of 5.3. Exploit code has been publicly disclosed but no known active exploitation in the wild is reported.
AI Analysis
Technical Summary
This vulnerability in jaychouchannel Tourism-Management-System involves improper authorization in the AuthorizationInterceptor.java file. It allows remote attackers to perform unauthorized actions due to insufficient authorization checks. The system uses a rolling release, so no fixed version numbers are provided. A patch commit d984d172dceca907f8b447efbdb06dc233f7938d addresses the issue. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to limited impacts on confidentiality, integrity, and availability.
Potential Impact
The vulnerability enables remote attackers to bypass authorization controls, potentially allowing unauthorized access or actions within the Tourism-Management-System. The impact is rated medium severity with limited confidentiality, integrity, and availability impact as per the CVSS vector. No active exploitation in the wild has been confirmed.
Mitigation Recommendations
Apply the patch identified by commit d984d172dceca907f8b447efbdb06dc233f7938d to remediate the improper authorization vulnerability. Since the product uses a rolling release model, ensure that the latest updates including this patch are applied promptly. No additional vendor advisory is available to indicate alternative mitigations or if the issue is already mitigated.
CVE-2026-90520: Improper Authorization in jaychouchannel Tourism-Management-System
Description
CVE-2026-90520 is an improper authorization vulnerability in the jaychouchannel Tourism-Management-System affecting the AuthorizationInterceptor.java component. The flaw allows remote attackers to bypass authorization controls. The product uses a rolling release model, so specific affected versions are not identified. A patch identified by commit d984d172dceca907f8b447efbdb06dc233f7938d is recommended to remediate the issue. The vulnerability has a medium severity with a CVSS 4.0 score of 5.3. Exploit code has been publicly disclosed but no known active exploitation in the wild is reported.
CVSS v4.0
Score 5.3medium
Affected software
jaychouchannel
Tourism-Management-System
cpe:2.3:a:jaychouchannel:tourism-management-system:*:*:*:*:*:*:*:*AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in jaychouchannel Tourism-Management-System involves improper authorization in the AuthorizationInterceptor.java file. It allows remote attackers to perform unauthorized actions due to insufficient authorization checks. The system uses a rolling release, so no fixed version numbers are provided. A patch commit d984d172dceca907f8b447efbdb06dc233f7938d addresses the issue. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to limited impacts on confidentiality, integrity, and availability.
Potential Impact
The vulnerability enables remote attackers to bypass authorization controls, potentially allowing unauthorized access or actions within the Tourism-Management-System. The impact is rated medium severity with limited confidentiality, integrity, and availability impact as per the CVSS vector. No active exploitation in the wild has been confirmed.
Mitigation Recommendations
Apply the patch identified by commit d984d172dceca907f8b447efbdb06dc233f7938d to remediate the improper authorization vulnerability. Since the product uses a rolling release model, ensure that the latest updates including this patch are applied promptly. No additional vendor advisory is available to indicate alternative mitigations or if the issue is already mitigated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-09-12T10:54:50.270Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aa71fe155bf5e2cf521a4eb
Added to database: 09/13/2026, 22:12:49 UTC
Last enriched: 09/13/2026, 22:14:38 UTC
Last updated: 09/14/2026, 03:01:22 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.