Tourism Management System CVE-2026-90524

The Tourism-Management-System must be deployed and its HTTP interface must be reachable by the attacker - no special configuration beyond deployment is required, as the @IgnoreAuth bypass is present in the default codebase for all commits up to 229956e. Affected endpoints are update operations in ChatmessageController, multiple Discuss* controllers (hotel, travel-strategy, route, restaurant, scenic-spot), ForumController, FriendController, FriendlinkController, NewsController, NewstypeController, and StoreupController. Exploitation is limited by the following factors: the product has near-zero enterprise adoption (hobby/student project), the attacker must know the exact endpoint URL paths (mitigated by the public POC), and impact is bounded to low-level data manipulation with no privilege escalation or system access. Authentication is entirely absent on these routes; no special user role or non-default configuration is required beyond reaching the application.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:L/VI:L/VA:L) reflects a remotely exploitable, low-complexity flaw requiring no privileges - even a mid-sized municipal deployment in a city like legnica would face genuine data integrity risk if this system were exposed to the internet. That said, real-world organizational priority should be tempered by product prevalence: this is a niche student/demonstration project with negligible enterprise footprint, so affected deployments are inherently rare. The public POC (GitHub Issue #11) lowers the attacker skill barrier, but no KEV listing confirms active exploitation at scale. CIA impact is uniformly low (L/L/L), meaning compromise allows data manipulation (integrity) and potential exposure of discussion/forum content, but no privilege escalation or availability disruption is implied. EPSS score was not provided in the input and cannot be stated with confidence; exploitation probability is inferred as low due to product obscurity. The patch commit is available and verified from the upstream GitHub repository.

An unauthenticated attacker sends an HTTP POST or PUT request directly to an exposed update endpoint (e.g., the forum or news update handler) without supplying any session token or credentials. Because @IgnoreAuth disables the authentication interceptor on that route, the application processes the request and modifies the target record. The public POC demonstrates this via GitHub Issue #11, confirming the endpoint paths and request structure are publicly known.