# CVE-2026-90520: Jaychou Tourism-Management-System improper authorization in Authorization Interceptor

Source: https://junglewise.ai/threats/cve-2026-90520-jaychou-tourism-management-system-improper-authorization-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-13. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-90520 · Severity: medium · CVSS 6.3 · Published 2026-09-13

The Tourism-Management-System is a full-featured tourism management platform built with Spring Boot and Vue.js. An improper authorization flaw in the Authorization Interceptor component allows attackers to bypass access controls remotely, potentially exposing administrative functions, user data, and booking information without proper credential validation.

## Quick answers

**Is CVE-2026-90520 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-90520 being exploited in the wild.

**How severe is CVE-2026-90520?** Medium severity, with a CVSS score of 6.3, published 13 September 2026.

**Which products and versions are affected?** Jaychou Tourism-Management-System up to 84d8ec384f669df3985293dab293bb7b477efa64.

**Is there a fix for CVE-2026-90520?** A patch was published on 2026-08-17: Patch commit d984d172dceca907f8b447efbdb06dc233f7938d resolves authorization issues Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-90520 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-90520?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is an improper authorization flaw in the AuthorizationInterceptor.java component of the Tourism-Management-System. The vulnerability allows remote attackers to bypass authorization checks, likely due to missing or insufficient permission validation in the interceptor logic. The exploit can be initiated remotely without authentication requirements. The patch (commit d984d172dceca907f8b447efbdb06dc233f7938d) resolves authorization issues by removing @IgnoreAuth annotations inappropriately applied to restricted endpoints, re-enabling proper authorization checks. Applying the patched version is recommended.

## Affected products

- Jaychou Tourism-Management-System up to 84d8ec384f669df3985293dab293bb7b477efa64

## Timeline

- 2026-09-13: disclosed
- 2026-08-17: patched: Patch commit d984d172dceca907f8b447efbdb06dc233f7938d resolves authorization issues

## References

- [https://github.com/jaychouchannel/Tourism-Management-System/](https://github.com/jaychouchannel/Tourism-Management-System/)
- [https://github.com/jaychouchannel/Tourism-Management-System/commit/d984d172dceca907f8b447efbdb06dc233f7938d](https://github.com/jaychouchannel/Tourism-Management-System/commit/d984d172dceca907f8b447efbdb06dc233f7938d)