Vulnerability-Lookup

GHSA-R377-9VPC-59G3

Vulnerability from github – Published: 2026-09-13 15:30 – Updated: 2026-09-13 15:30

Details

A vulnerability has been found in jaychouchannel Tourism-Management-System up to 84d8ec384f669df3985293dab293bb7b477efa64. This vulnerability affects unknown code of the file AuthorizationInterceptor.java of the component Authorization Interceptor. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The identifier of the patch is d984d172dceca907f8b447efbdb06dc233f7938d. Applying a patch is the recommended action to fix this issue.

Severity

6.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

2.1 (Low)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-90520"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-266"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-13T13:16:28Z",
    "severity": "LOW"
  },
  "details": "A vulnerability has been found in jaychouchannel Tourism-Management-System up to 84d8ec384f669df3985293dab293bb7b477efa64. This vulnerability affects unknown code of the file AuthorizationInterceptor.java of the component Authorization Interceptor. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The identifier of the patch is d984d172dceca907f8b447efbdb06dc233f7938d. Applying a patch is the recommended action to fix this issue.",
  "id": "GHSA-r377-9vpc-59g3",
  "modified": "2026-09-13T15:30:21Z",
  "published": "2026-09-13T15:30:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90520"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jaychouchannel/Tourism-Management-System/issues/12"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jaychouchannel/Tourism-Management-System/commit/d984d172dceca907f8b447efbdb06dc233f7938d"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jaychouchannel/Tourism-Management-System"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/cve/CVE-2026-90520"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/912234"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/403110"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/403110/cti"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

CVE-2026-90520 (GCVE-0-2026-90520)

Vulnerability from cvelistv5 – Published: 2026-09-13 12:30 – Updated: 2026-09-13 12:30 X_Open Source

Title

jaychouchannel Tourism-Management-System Authorization Interceptor AuthorizationInterceptor.java improper authorization

Summary

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

6.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

6.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

CWE

CWE-285 - Improper Authorization
CWE-266 - Incorrect Privilege Assignment

Assigner

VulDB mitre root

References

7 references

URL	Tags
https://vuldb.com/vuln/403110	vdb-entry
https://vuldb.com/vuln/403110/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-90520	third-party-advisory
https://vuldb.com/submit/912234	third-party-advisory
https://github.com/jaychouchannel/Tourism-Managem…	exploitissue-tracking
https://github.com/jaychouchannel/Tourism-Managem…	patch
https://github.com/jaychouchannel/Tourism-Managem…	product

Impacted products

1 product

Vendor	Product	Version
jaychouchannel	Tourism-Management-System	Affected: 84d8ec384f669df3985293dab293bb7b477efa64 cpe:2.3:a:jaychouchannel:tourism-management-system::::::::

Credits

Djie (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:jaychouchannel:tourism-management-system:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Authorization Interceptor"
          ],
          "product": "Tourism-Management-System",
          "vendor": "jaychouchannel",
          "versions": [
            {
              "status": "affected",
              "version": "84d8ec384f669df3985293dab293bb7b477efa64"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Djie (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been found in jaychouchannel Tourism-Management-System up to 84d8ec384f669df3985293dab293bb7b477efa64. This vulnerability affects unknown code of the file AuthorizationInterceptor.java of the component Authorization Interceptor. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The identifier of the patch is d984d172dceca907f8b447efbdb06dc233f7938d. Applying a patch is the recommended action to fix this issue."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 6.5,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-266",
              "description": "Incorrect Privilege Assignment",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T12:30:10.123Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-403110 | jaychouchannel Tourism-Management-System Authorization Interceptor AuthorizationInterceptor.java improper authorization",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://vuldb.com/vuln/403110"
        },
        {
          "name": "VDB-403110 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/403110/cti"
        },
        {
          "name": "CVE-2026-90520 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-90520"
        },
        {
          "name": "Submit #912234 | jaychouchannel Tourism_Management_System 8122bf020d91199eddfff3ee02d1632a70a9a132 Improper Authorization",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/912234"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/jaychouchannel/Tourism-Management-System/issues/12"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/jaychouchannel/Tourism-Management-System/commit/d984d172dceca907f8b447efbdb06dc233f7938d"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/jaychouchannel/Tourism-Management-System/"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-12T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-12T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-12T13:00:10.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "jaychouchannel Tourism-Management-System Authorization Interceptor AuthorizationInterceptor.java improper authorization",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-90520",
    "datePublished": "2026-09-13T12:30:10.123Z",
    "dateReserved": "2026-09-12T10:54:50.270Z",
    "dateUpdated": "2026-09-13T12:30:10.123Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-R377-9VPC-59G3

CVE-2026-90520 (GCVE-0-2026-90520)

Tags

Sightings

Nomenclature