# CVE-2026-90523: jaychouchannel Tourism-Management-System privilege escalation in user registration

Source: https://junglewise.ai/threats/cve-2026-90523-jaychouchannel-tourism-management-system-privilege-escalation-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-13. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-90523 · Severity: high · CVSS 7.3 · Published 2026-09-13

A tourism management web application contains a privilege escalation vulnerability in its user registration endpoint. An attacker can create an administrator account instead of a regular user account by manipulating the user role parameter during registration, gaining unauthorized administrative access to the system and potentially compromising all customer and operational data.

Technologies: [Jaychouchannel Tourism Management System](https://junglewise.ai/threats/technologies/tourism-management-system). Vendors: [Jaychouchannel](https://junglewise.ai/threats/vendors/jaychouchannel).

## Quick answers

**Is CVE-2026-90523 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-90523 being exploited in the wild.

**How severe is CVE-2026-90523?** High severity, with a CVSS score of 7.3, published 13 September 2026.

**Which products and versions are affected?** Jaychouchannel Tourism Management System up to commit 229956e20dbd4a80eeff14535e44d3099502af09.

**Is there a fix for CVE-2026-90523?** A patch was published on 2026-08-15: Commit 84d8ec384f669df3985293dab293bb7b477efa64 resolves the authorization issues Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-90523 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-90523?** Check whether you run Jaychouchannel Tourism Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an improper privilege management flaw in the User Register endpoint (UsersController.java) of the Tourism-Management-System, a Spring Boot-based tourism management platform. The /users/register endpoint fails to enforce the user role during registration, allowing remote unauthenticated attackers to manipulate the UsersEntity parameter to assign administrator privileges to newly created accounts. The attack requires no authentication or user interaction and can be exploited via a direct network request to the registration endpoint. An attacker can achieve full administrative access to the system, enabling modification of users, deletion of data, or further system compromise. Patch 84d8ec384f669df3985293dab293bb7b477efa64 resolves this by forcing the normal user role on public /users/register endpoint.

## Affected products

- jaychouchannel Tourism-Management-System up to commit 229956e20dbd4a80eeff14535e44d3099502af09

## Timeline

- 2026-09-13: disclosed
- 2026-08-15: patched: Commit 84d8ec384f669df3985293dab293bb7b477efa64 resolves the authorization issues

## References

- [https://github.com/jaychouchannel/Tourism-Management-System/](https://github.com/jaychouchannel/Tourism-Management-System/)
- [https://github.com/jaychouchannel/Tourism-Management-System/commit/84d8ec384f669df3985293dab293bb7b477efa64](https://github.com/jaychouchannel/Tourism-Management-System/commit/84d8ec384f669df3985293dab293bb7b477efa64)

## Related threats

- [jaychouchannel Tourism-Management-System auth bypass in update endpoints](https://junglewise.ai/threats/cve-2026-90524-jaychouchannel-tourism-management-system-auth-bypass-in-update)
- [jaychouchannel Tourism-Management-System weak password recovery](https://junglewise.ai/threats/cve-2026-90522-jaychouchannel-tourism-management-system-weak-password-recovery)
- [jaychouchannel Tourism-Management-System authorization bypass in CRUD](https://junglewise.ai/threats/cve-2026-90521-jaychouchannel-tourism-management-system-authorization-bypass-in)
- [Tourism Management System SQL injection in CommonController](https://junglewise.ai/threats/cve-2026-86284-tourism-management-system-sql-injection-in-commoncontroller)
- [jaychouchannel Tourism-Management-System SQL injection in CommonController](https://junglewise.ai/threats/cve-2026-86282-jaychouchannel-tourism-management-system-sql-injection-in)