Executive brief
Tourism-Management-System is a Spring Boot-based platform for managing tourism businesses, hotels, restaurants, and tours. The application was missing authentication checks on multiple update endpoints, allowing unauthenticated attackers to remotely modify critical data such as user accounts, roles, and business information without authorization. This could enable account takeover, privilege escalation, and data manipulation attacks.
Technical details
The vulnerability is a missing authentication flaw in 12 update endpoints within the application's Update Endpoint component. The root cause was improper use of the @IgnoreAuth annotation, which disabled security checks on endpoints that should have required authentication. An unauthenticated attacker can send HTTP requests to these update endpoints over the network to modify system data, including user roles and account details, without any credentials. The issue was patched in commit 84d8ec384f669df3985293dab293bb7b477efa64 by removing @IgnoreAuth decorators from the vulnerable endpoints and implementing proper authorization checks for user management operations.
Affected products
- jaychouchannel Tourism-Management-System up to commit 229956e20dbd4a80eeff14535e44d3099502af09
Timeline
- 2026-09-13: disclosed
- 2026-08-15: patched: Patch commit 84d8ec384f669df3985293dab293bb7b477efa64