Is CVE-2026-90521 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-90521 being exploited in the wild.

How severe is CVE-2026-90521?

Medium severity, with a CVSS score of 6.3, published 13 September 2026.

Which products and versions are affected?

Jaychouchannel Tourism Management System up to 8122bf020d91199eddfff3ee02d1632a70a9a132.

Is there a fix for CVE-2026-90521?

A patch was published on 2026-09-13: Patch available as commit d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-90521 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-90521?

Check whether you run Jaychouchannel Tourism Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-90521: jaychouchannel Tourism-Management-System authorization bypass in CRUD

CVE-2026-90521 · Severity: medium · CVSS 6.3 · Published 2026-09-13

Tourism-Management-System is a web-based platform for managing travel businesses, including attractions, hotels, restaurants, and ticketing. A flaw in the CRUD (data modification) component allows attackers to bypass authorization checks by manipulating request parameters, potentially gaining unauthorized access to sensitive business data or making unauthorized changes to the system.

Technologies: Jaychouchannel Tourism Management System. Vendors: Jaychouchannel.

Quick answers

Is CVE-2026-90521 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-90521 being exploited in the wild.
How severe is CVE-2026-90521?: Medium severity, with a CVSS score of 6.3, published 13 September 2026.
Which products and versions are affected?: Jaychouchannel Tourism Management System up to 8122bf020d91199eddfff3ee02d1632a70a9a132.
Is there a fix for CVE-2026-90521?: A patch was published on 2026-09-13: Patch available as commit d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-90521 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-90521?: Check whether you run Jaychouchannel Tourism Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authorization bypass vulnerability exists in the MenpiaodingdanController.java component of Tourism-Management-System. The vulnerability is triggered by improper validation of the ID argument in CRUD operations, allowing attackers to access or modify records they should not have permission to access. The vulnerability is network-accessible and requires no authentication. The exploit is public, and a patch (commit d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86) is available and should be applied immediately.

Affected products

jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132

Timeline

2026-09-13: disclosed: CVE-2026-90521 published
2026-09-13: patched: Patch available as commit d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.