Executive brief
A tourism management web application contains a privilege escalation vulnerability in its user registration endpoint. An attacker can create an administrator account instead of a regular user account by manipulating the user role parameter during registration, gaining unauthorized administrative access to the system and potentially compromising all customer and operational data.
Technical details
The vulnerability is an improper privilege management flaw in the User Register endpoint (UsersController.java) of the Tourism-Management-System, a Spring Boot-based tourism management platform. The /users/register endpoint fails to enforce the user role during registration, allowing remote unauthenticated attackers to manipulate the UsersEntity parameter to assign administrator privileges to newly created accounts. The attack requires no authentication or user interaction and can be exploited via a direct network request to the registration endpoint. An attacker can achieve full administrative access to the system, enabling modification of users, deletion of data, or further system compromise. Patch 84d8ec384f669df3985293dab293bb7b477efa64 resolves this by forcing the normal user role on public /users/register endpoint.
Affected products
- jaychouchannel Tourism-Management-System up to commit 229956e20dbd4a80eeff14535e44d3099502af09
Timeline
- 2026-09-13: disclosed
- 2026-08-15: patched: Commit 84d8ec384f669df3985293dab293bb7b477efa64 resolves the authorization issues