# CVE-2026-90524: jaychouchannel Tourism-Management-System auth bypass in update endpoints

Source: https://junglewise.ai/threats/cve-2026-90524-jaychouchannel-tourism-management-system-auth-bypass-in-update  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-13. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-90524 · Severity: high · CVSS 7.3 · Published 2026-09-13

Tourism-Management-System is a Spring Boot-based platform for managing tourism businesses, hotels, restaurants, and tours. The application was missing authentication checks on multiple update endpoints, allowing unauthenticated attackers to remotely modify critical data such as user accounts, roles, and business information without authorization. This could enable account takeover, privilege escalation, and data manipulation attacks.

Technologies: [Jaychouchannel Tourism Management System](https://junglewise.ai/threats/technologies/tourism-management-system). Vendors: [Jaychouchannel](https://junglewise.ai/threats/vendors/jaychouchannel).

## Quick answers

**Is CVE-2026-90524 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-90524 being exploited in the wild.

**How severe is CVE-2026-90524?** High severity, with a CVSS score of 7.3, published 13 September 2026.

**Which products and versions are affected?** Jaychouchannel Tourism Management System up to commit 229956e20dbd4a80eeff14535e44d3099502af09.

**Is there a fix for CVE-2026-90524?** A patch was published on 2026-08-15: Patch commit 84d8ec384f669df3985293dab293bb7b477efa64 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-90524 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-90524?** Check whether you run Jaychouchannel Tourism Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a missing authentication flaw in 12 update endpoints within the application's Update Endpoint component. The root cause was improper use of the @IgnoreAuth annotation, which disabled security checks on endpoints that should have required authentication. An unauthenticated attacker can send HTTP requests to these update endpoints over the network to modify system data, including user roles and account details, without any credentials. The issue was patched in commit 84d8ec384f669df3985293dab293bb7b477efa64 by removing @IgnoreAuth decorators from the vulnerable endpoints and implementing proper authorization checks for user management operations.

## Affected products

- jaychouchannel Tourism-Management-System up to commit 229956e20dbd4a80eeff14535e44d3099502af09

## Timeline

- 2026-09-13: disclosed
- 2026-08-15: patched: Patch commit 84d8ec384f669df3985293dab293bb7b477efa64

## References

- [https://github.com/jaychouchannel/Tourism-Management-System/](https://github.com/jaychouchannel/Tourism-Management-System/)
- [https://github.com/jaychouchannel/Tourism-Management-System/commit/84d8ec384f669df3985293dab293bb7b477efa64](https://github.com/jaychouchannel/Tourism-Management-System/commit/84d8ec384f669df3985293dab293bb7b477efa64)

## Related threats

- [jaychouchannel Tourism-Management-System privilege escalation in user registration](https://junglewise.ai/threats/cve-2026-90523-jaychouchannel-tourism-management-system-privilege-escalation-in)
- [jaychouchannel Tourism-Management-System weak password recovery](https://junglewise.ai/threats/cve-2026-90522-jaychouchannel-tourism-management-system-weak-password-recovery)
- [jaychouchannel Tourism-Management-System authorization bypass in CRUD](https://junglewise.ai/threats/cve-2026-90521-jaychouchannel-tourism-management-system-authorization-bypass-in)
- [Tourism Management System SQL injection in CommonController](https://junglewise.ai/threats/cve-2026-86284-tourism-management-system-sql-injection-in-commoncontroller)
- [jaychouchannel Tourism-Management-System SQL injection in CommonController](https://junglewise.ai/threats/cve-2026-86282-jaychouchannel-tourism-management-system-sql-injection-in)