{"id":"CVE-2026-90523","summary":"jaychouchannel Tourism-Management-System User Register Endpoint UsersController.java privileges management","details":"A vulnerability was identified in jaychouchannel Tourism-Management-System up to 229956e20dbd4a80eeff14535e44d3099502af09. The affected element is an unknown function of the file travel/src/main/java/com/controller/UsersController.java of the component User Register Endpoint. Such manipulation of the argument UsersEntity leads to improper privilege management. The attack can be launched remotely. The exploit is publicly available and might be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The name of the patch is 84d8ec384f669df3985293dab293bb7b477efa64. Applying a patch is advised to resolve this issue.","modified":"2026-10-21T10:48:51.142896816Z","published":"2026-09-13T13:15:18.551Z","database_specific":{"cwe_ids":["CWE-266","CWE-269"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90523.json","cna_assigner":"VulDB"},"references":[{"type":"WEB","url":"https://github.com/jaychouchannel/Tourism-Management-System/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90523.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90523"},{"type":"ADVISORY","url":"https://vuldb.com/cve/CVE-2026-90523"},{"type":"ADVISORY","url":"https://vuldb.com/submit/912244"},{"type":"ADVISORY","url":"https://vuldb.com/vuln/403113"},{"type":"REPORT","url":"https://github.com/jaychouchannel/Tourism-Management-System/issues/10"},{"type":"REPORT","url":"https://vuldb.com/vuln/403113/cti"},{"type":"FIX","url":"https://github.com/jaychouchannel/Tourism-Management-System/commit/84d8ec384f669df3985293dab293bb7b477efa64"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jaychouchannel/tourism-management-system","events":[{"introduced":"229956e20dbd4a80eeff14535e44d3099502af09"},{"fixed":"84d8ec384f669df3985293dab293bb7b477efa64"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"229956e20dbd4a80eeff14535e44d3099502af09"},{"last_affected":"229956e20dbd4a80eeff14535e44d3099502af09"}]},{"range":[{"fixed":"84d8ec384f669df3985293dab293bb7b477efa64"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["229956e20dbd4a80eeff14535e44d3099502af09"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90523.json","vanir_signatures":[{"source":"https://github.com/jaychouchannel/tourism-management-system/commit/84d8ec384f669df3985293dab293bb7b477efa64","target":{"file":"travel/src/main/java/com/controller/DiscussjiudianxinxiController.java"},"deprecated":false,"digest":{"line_hashes":["41014553720754747213129855517079154014","1510151887905267182586449104041252304","32757541173665388847623920277695892305","9798368509815479234805798222265973109"],"threshold":0.9},"id":"CVE-2026-90523-08801a55","signature_type":"Line","signature_version":"v1"},{"digest":{"line_hashes":["41014553720754747213129855517079154014","89938220429199192656914482516976385743","148810940127412544954149649065053266805","30810971176066771867478194652797185409"],"threshold":0.9},"id":"CVE-2026-90523-19740fbc","signature_type":"Line","signature_version":"v1","source":"https://github.com/jaychouchannel/tourism-management-system/commit/84d8ec384f669df3985293dab293bb7b477efa64","target":{"file":"travel/src/main/java/com/controller/DiscussmeishicantingController.java"},"deprecated":false},{"source":"https://github.com/jaychouchannel/tourism-management-system/commit/84d8ec384f669df3985293dab293bb7b477efa64","target":{"file":"travel/src/main/java/com/controller/ChatmessageController.java"},"deprecated":false,"digest":{"line_hashes":["41014553720754747213129855517079154014","47213905344086985607609986214449526003","41392102217314572388621331186083189797","41253932149451308084898503485910501272"],"threshold":0.9},"id":"CVE-2026-90523-1fe342e3","signature_type":"Line","signature_version":"v1"},{"target":{"file":"travel/src/main/java/com/controller/NewsController.java"},"deprecated":false,"digest":{"line_hashes":["41014553720754747213129855517079154014","5888259048988515772633030959069654917","331206065680908644802675225517007000855","129028748044122831172469056755907819977"],"threshold":0.9},"id":"CVE-2026-90523-2000f794","signature_type":"Line","signature_version":"v1","source":"https://github.com/jaychouchannel/tourism-management-system/commit/84d8ec384f669df3985293dab293bb7b477efa64"},{"source":"https://github.com/jaychouchannel/tourism-management-system/commit/84d8ec384f669df3985293dab293bb7b477efa64","target":{"file":"travel/src/main/java/com/controller/ForumController.java"},"deprecated":false,"digest":{"line_hashes":["41014553720754747213129855517079154014","52792056692044045623281384391902652316","324138563088908210866286047923657712488","297864360182968128797753560039442195560"],"threshold":0.9},"id":"CVE-2026-90523-2624631b","signature_type":"Line","signature_version":"v1"},{"digest":{"threshold":0.9,"line_hashes":["41014553720754747213129855517079154014","155049830096092638856858619696698220490","330112123056670866025545205572688884505","124917280261373170884636583508298656157"]},"id":"CVE-2026-90523-622f4735","signature_type":"Line","signature_version":"v1","source":"https://github.com/jaychouchannel/tourism-management-system/commit/84d8ec384f669df3985293dab293bb7b477efa64","target":{"file":"travel/src/main/java/com/controller/DiscusslvyouxianluController.java"},"deprecated":false},{"digest":{"line_hashes":["41014553720754747213129855517079154014","181038890164368042186317456637895765488","241553076833333702740789413235319981365","116734030885873626903271640405150486742"],"threshold":0.9},"id":"CVE-2026-90523-6399d304","signature_type":"Line","signature_version":"v1","source":"https://github.com/jaychouchannel/tourism-management-system/commit/84d8ec384f669df3985293dab293bb7b477efa64","target":{"file":"travel/src/main/java/com/controller/FriendlinkController.java"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/jaychouchannel/tourism-management-system/commit/84d8ec384f669df3985293dab293bb7b477efa64","target":{"file":"travel/src/main/java/com/controller/DiscusslvyougonglveController.java"},"deprecated":false,"digest":{"line_hashes":["41014553720754747213129855517079154014","292334798979686848413755533362104937074","82283210252753032525804081122158862605","7369570383216483976072195443537923351"],"threshold":0.9},"id":"CVE-2026-90523-74f7c453","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["41014553720754747213129855517079154014","268303945667469126851112290290872473171","74833693908912451796624515882475819057","120313840309549630133159743963795786361"],"threshold":0.9},"id":"CVE-2026-90523-7bf611ad","signature_type":"Line","signature_version":"v1","source":"https://github.com/jaychouchannel/tourism-management-system/commit/84d8ec384f669df3985293dab293bb7b477efa64","target":{"file":"travel/src/main/java/com/controller/DiscussremenjingdianController.java"}},{"digest":{"line_hashes":["41014553720754747213129855517079154014","78335271404540812404418968451016504332","22620790659802622079449933228002518345","252191504866874412576432720326686549441"],"threshold":0.9},"id":"CVE-2026-90523-8c4f5404","signature_type":"Line","signature_version":"v1","source":"https://github.com/jaychouchannel/tourism-management-system/commit/84d8ec384f669df3985293dab293bb7b477efa64","target":{"file":"travel/src/main/java/com/controller/NewstypeController.java"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["41014553720754747213129855517079154014","14436421123829602486048568932635765957","168696206330163481169630788586065991179","70717625996343693951956437341469379515"],"threshold":0.9},"id":"CVE-2026-90523-b40ed19a","signature_type":"Line","signature_version":"v1","source":"https://github.com/jaychouchannel/tourism-management-system/commit/84d8ec384f669df3985293dab293bb7b477efa64","target":{"file":"travel/src/main/java/com/controller/StoreupController.java"}},{"target":{"file":"travel/src/main/java/com/controller/FriendController.java"},"deprecated":false,"digest":{"line_hashes":["41014553720754747213129855517079154014","17193502332962202147348428669050213487","224122339849933588359841807212981618537","162727424050264276382208977803128928716"],"threshold":0.9},"id":"CVE-2026-90523-bb7b8e53","signature_type":"Line","signature_version":"v1","source":"https://github.com/jaychouchannel/tourism-management-system/commit/84d8ec384f669df3985293dab293bb7b477efa64"},{"deprecated":false,"digest":{"function_hash":"248032252367280849326557361905560872022","length":1631},"id":"CVE-2026-90523-d06d61f5","signature_type":"Function","signature_version":"v1","source":"https://github.com/jaychouchannel/tourism-management-system/commit/84d8ec384f669df3985293dab293bb7b477efa64","target":{"function":"preHandle","file":"travel/src/main/java/com/interceptor/AuthorizationInterceptor.java"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/jaychouchannel/tourism-management-system/commit/84d8ec384f669df3985293dab293bb7b477efa64","target":{"file":"travel/src/main/java/com/interceptor/AuthorizationInterceptor.java"},"deprecated":false,"digest":{"line_hashes":["182666167043646849483842404685895899107","175819716304157808468298993203143512541","114575701617552473567112502710136505145","130827707540499110167079773872905566513","193945555105656936453847297800470789796","183325986263730029783145769233746546977"],"threshold":0.9},"id":"CVE-2026-90523-ec46ea20"}],"vanir_signatures_modified":"2026-10-21T10:48:51Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}]}