CVE-2026-90521

A vulnerability was found in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132. This issue affects some unknown processing of the file MenpiaodingdanController.java of the component CRUD. The manipulation of the argument ID results in authorization bypass. It is possible to launch the attack remotely. The exploit has been made public and could be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The patch is identified as d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86. It is best practice to apply a patch to resolve this issue.

• CWE-285
• CWE-639

• https://github.com/jaychouchannel/Tourism-Management-System/
• https://github.com/jaychouchannel/Tourism-Management-System/commit/d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86
• https://github.com/jaychouchannel/Tourism-Management-System/issues/9
• https://github.com/jaychouchannel/Tourism-Management-System/pull/14
• https://vuldb.com/cve/CVE-2026-90521
• https://vuldb.com/submit/912235
• https://vuldb.com/vuln/403111
• https://vuldb.com/vuln/403111/cti

Published

Sep 13, 2026

Last Modified

Sep 14, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-90516A vulnerability was found in SourceCodester School Registrat…7.3
• CVE-2026-90517A vulnerability was identified in PHPGurukul Bank Locker Man…5.3
• CVE-2026-90518A security flaw has been discovered in PHPGurukul Bank Locke…6.3
• CVE-2026-90519A weakness has been identified in PHPGurukul Bank Locker Man…6.3
• CVE-2026-9052Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-90520A vulnerability has been found in jaychouchannel Tourism-Man…6.3
• CVE-2026-90522A vulnerability was determined in jaychouchannel Tourism-Man…7.3
• CVE-2026-90523A vulnerability was identified in jaychouchannel Tourism-Man…7.3
• CVE-2026-90524A security flaw has been discovered in jaychouchannel Touris…7.3
• CVE-2026-90525A weakness has been identified in itsourcecode Sales and Inv…6.3
• CVE-2026-90526A security vulnerability has been detected in SourceCodester…7.3
• CVE-2026-90527A vulnerability was detected in quequnlong shiyi-blog up to …4.3