EUVD-2026-77021
GHSA-phcr-xqg5-c575
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach registration HTTP endpoint
-
DeliveryPOST crafted UsersEntity with admin role field
-
ExploitApplication persists account with elevated privileges
-
ExecutionAuthenticate as self-created admin
-
ImpactAccess all administrative functions and data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No authentication is required; the registration endpoint is intentionally public-facing. The attacker must be able to reach the HTTP/HTTPS port of the Tourism Management System deployment over the network. Exploitation requires that the application is running and self-registration is enabled (the default deployment mode). The secondary @IgnoreAuth issue on security() endpoints requires that those specific URL paths are reachable and that the application has not applied the patch commit. No special client software, credentials, or platform configuration is needed beyond sending a crafted HTTP request with a manipulated UsersEntity payload. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) correctly captures that exploitation requires no authentication, no user interaction, and no special attack precondition - a straight remote unauthenticated HTTP request. However, the impact metrics VC:L/VI:L/VA:L appear understated for a privilege escalation to admin: an attacker who self-registers as administrator gains read/write access to all application data, which should place VI at H. The overall score of 6.9 is therefore conservative relative to the actual privilege impact. EPSS data is not provided, but given the obscure deployment footprint and niche application, real-world exploitation pressure is expected to be low despite publicly available exploit code. No KEV listing, no widespread deployment - this is a meaningful risk only to the specific organizations running this exact software. |
| Exploit ScenarioDerived | An attacker sends a crafted HTTP POST request to the user registration endpoint, including a JSON body for UsersEntity that sets the role field to an administrator value (e.g., roleId=1 or role='admin'). The application deserializes the entity without stripping the role field and persists the account with full administrative privileges. The attacker then authenticates as this self-created admin account and has unrestricted access to all application management functions. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 13, 2026
Unauthenticated remote attackers can register accounts with elevated (administrator) privileges in jaychouchannel Tourism-Management-System by manipulating the UsersEntity parameter during registration, bypassing role assignment controls. The commit diff reveals a broader scope than the description implies: at least 12 controller classes (ChatmessageController, multiple Discuss* controllers, ForumController, FriendController, FriendlinkController, NewsController, NewstypeController, StoreupController) had security() endpoints decorated with @IgnoreAuth, making those endpoints callable without any authentication. Publicly available exploit code exists; no active exploitation confirmed in CISA KEV.
RemediationAI
Apply the upstream fix at commit 84d8ec384f669df3985293dab293bb7b477efa64, available at https://github.com/jaychouchannel/Tourism-Management-System/commit/84d8ec384f669df3985293dab293bb7b477efa64. The patch removes @IgnoreAuth from security() endpoints across twelve controllers. Operators should also manually audit UsersController.java to confirm that the registration endpoint strips or ignores role/privilege fields from incoming UsersEntity objects before persistence, as UsersController.java does not appear in the patch diff. If deployment cannot be updated immediately, restrict network access to the application to trusted IP ranges and disable self-registration if that feature is not required, accepting the trade-off of blocking new user onboarding.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected product is a Spring Boot Java web application (cpe:2.3:a:jaychouchannel:tourism-management-system). The @IgnoreAuth annotation in this framework instructs authentication interceptors to skip credential verification for marked endpoints. CWE-269 (Improper Privilege Management) manifests here as mass assignment: the /user/register (or equivalent) endpoint in UsersController.java accepts a deserialized UsersEntity object from the client without stripping or validating role/privilege fields, allowing a registrant to self-assign an administrator role. The patch (commit 84d8ec384f669df3985293dab293bb7b477efa64) removes @IgnoreAuth from security() methods across twelve controller files, closing the unauthenticated access paths to those endpoints; however, the UsersController.java file itself does not appear in the diff, leaving the specific registration-path privilege assignment fix unconfirmed from the diff alone.
Know when Java gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-reachable registration endpoint, no auth needed, self-assigned admin role yields high integrity impact over all application data.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was identified in jaychouchannel Tourism-Management-System up to 229956e20dbd4a80eeff14535e44d3099502af09. The affected element is an unknown function of the file travel/src/main/java/com/controller/UsersController.java of the component User Register Endpoint. Such manipulation of the argument UsersEntity leads to improper privilege management. The attack can be launched remotely. The exploit is publicly available and might be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The name of the patch is 84d8ec384f669df3985293dab293bb7b477efa64. Applying a patch is advised to resolve this issue.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Exploit-DB