# CVE-2026-90521: jaychouchannel Tourism-Management-System authorization bypass in CRUD

Source: https://junglewise.ai/threats/cve-2026-90521-jaychouchannel-tourism-management-system-authorization-bypass-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-13. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-90521 · Severity: medium · CVSS 6.3 · Published 2026-09-13

Tourism-Management-System is a web-based platform for managing travel businesses, including attractions, hotels, restaurants, and ticketing. A flaw in the CRUD (data modification) component allows attackers to bypass authorization checks by manipulating request parameters, potentially gaining unauthorized access to sensitive business data or making unauthorized changes to the system.

Technologies: [Jaychouchannel Tourism Management System](https://junglewise.ai/threats/technologies/tourism-management-system). Vendors: [Jaychouchannel](https://junglewise.ai/threats/vendors/jaychouchannel).

## Quick answers

**Is CVE-2026-90521 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-90521 being exploited in the wild.

**How severe is CVE-2026-90521?** Medium severity, with a CVSS score of 6.3, published 13 September 2026.

**Which products and versions are affected?** Jaychouchannel Tourism Management System up to 8122bf020d91199eddfff3ee02d1632a70a9a132.

**Is there a fix for CVE-2026-90521?** A patch was published on 2026-09-13: Patch available as commit d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-90521 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-90521?** Check whether you run Jaychouchannel Tourism Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authorization bypass vulnerability exists in the MenpiaodingdanController.java component of Tourism-Management-System. The vulnerability is triggered by improper validation of the ID argument in CRUD operations, allowing attackers to access or modify records they should not have permission to access. The vulnerability is network-accessible and requires no authentication. The exploit is public, and a patch (commit d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86) is available and should be applied immediately.

## Affected products

- jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132

## Timeline

- 2026-09-13: disclosed: CVE-2026-90521 published
- 2026-09-13: patched: Patch available as commit d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86

## References

- [https://github.com/jaychouchannel/Tourism-Management-System/](https://github.com/jaychouchannel/Tourism-Management-System/)
- [https://github.com/jaychouchannel/Tourism-Management-System/commit/d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86](https://github.com/jaychouchannel/Tourism-Management-System/commit/d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86)

## Related threats

- [jaychouchannel Tourism-Management-System auth bypass in update endpoints](https://junglewise.ai/threats/cve-2026-90524-jaychouchannel-tourism-management-system-auth-bypass-in-update)
- [jaychouchannel Tourism-Management-System privilege escalation in user registration](https://junglewise.ai/threats/cve-2026-90523-jaychouchannel-tourism-management-system-privilege-escalation-in)
- [jaychouchannel Tourism-Management-System weak password recovery](https://junglewise.ai/threats/cve-2026-90522-jaychouchannel-tourism-management-system-weak-password-recovery)
- [Tourism Management System SQL injection in CommonController](https://junglewise.ai/threats/cve-2026-86284-tourism-management-system-sql-injection-in-commoncontroller)
- [jaychouchannel Tourism-Management-System SQL injection in CommonController](https://junglewise.ai/threats/cve-2026-86282-jaychouchannel-tourism-management-system-sql-injection-in)