Quick answers
- Is CVE-2026-90522 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-90522 being exploited in the wild.
- How severe is CVE-2026-90522?
- High severity, with a CVSS score of 7.3, published 13 September 2026.
- Which products and versions are affected?
- Jaychouchannel Tourism Management System up to commit d984d172dceca907f8b447efbdb06dc233f7938d.
- Is there a fix for CVE-2026-90522?
- A patch was published on 2026-09-13: Patch commit 9cb6215ac871f99a90cde763cf003e95ff282283 includes old password verification requirement Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-90522 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-90522?
- Check whether you run Jaychouchannel Tourism Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability exists in the resetPass function of UsersController.java within the Password Recovery component, where insufficient authentication controls allow weak or unauthorized password recovery. The flaw is accessible remotely and does not require prior authentication, though the exact attack preconditions are not fully detailed in available sources. An attacker can exploit this to reset arbitrary user passwords without valid credentials or verification. The vulnerability has been patched in commit 9cb6215ac871f99a90cde763cf003e95ff282283, which implements old password verification requirements for password reset operations.
Affected products
- jaychouchannel Tourism-Management-System up to commit d984d172dceca907f8b447efbdb06dc233f7938d
Timeline
- 2026-09-13: disclosed
- 2026-09-13: patched: Patch commit 9cb6215ac871f99a90cde763cf003e95ff282283 includes old password verification requirement