Is there a public PoC exploit available for CVE-2026-90524?

Yes, a public proof-of-concept exploit is available for CVE-2026-90524. Prioritise patching immediately. EPSS: 0.7%.

Is there a patch available for CVE-2026-90524?

Yes, a patch is available for CVE-2026-90524. Update the affected software to the latest version immediately.

Tourism Management System CVE-2026-90524

Q: What is the CVSS score of CVE-2026-90524?

CVE-2026-90524 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

EUVD-2026-77022 MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-09-13 VulDB

GHSA-86mv-h6pr-c65g

Authentication Bypass Tourism Management System

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable, no privileges or interaction needed due to @IgnoreAuth bypass; only low integrity/confidentiality impact from data manipulation, no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Sep 13, 2026 - 14:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Source Code Evidence Fetched

Sep 13, 2026 - 14:16 vuln.today

Analysis Generated

Sep 13, 2026 - 14:16 vuln.today

CVE Published

Sep 13, 2026 - 13:30 cve.org

MEDIUM 6.9

DescriptionCVE.org

A security flaw has been discovered in jaychouchannel Tourism-Management-System up to 229956e20dbd4a80eeff14535e44d3099502af09. The impacted element is an unknown function of the component Update Endpoint. Performing a manipulation results in missing authentication. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The patch is named 84d8ec384f669df3985293dab293bb7b477efa64. It is suggested to install a patch to address this issue.

AnalysisAI

Missing authentication on update endpoints in jaychouchannel's Tourism-Management-System exposes write operations across 12 Spring controllers - including chat messages, forum posts, hotel/restaurant discussions, news, friend links, and bookmarks - to unauthenticated remote attackers. The root cause is confirmed by the patch commit (84d8ec3): the custom @IgnoreAuth annotation was incorrectly applied to update-path handlers, causing the authentication interceptor to skip those routes entirely. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The Tourism-Management-System must be deployed and its HTTP interface must be reachable by the attacker - no special configuration beyond deployment is required, as the `@IgnoreAuth` bypass is present in the default codebase for all commits up to 229956e. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:L/VI:L/VA:L) reflects a remotely exploitable, low-complexity flaw requiring no privileges - even a mid-sized municipal deployment in a city like legnica would face genuine data integrity risk if this system were exposed to the internet. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply the upstream patch commit 84d8ec384f669df3985293dab293bb7b477efa64, available at https://github.com/jaychouchannel/Tourism-Management-System/commit/84d8ec384f669df3985293dab293bb7b477efa64. … Detailed patch versions, workarounds, and compensating controls in full report.