Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CVE-2026-90523
jaychouchannel Tourism-Management-System User Register Endpoint UsersController.java privileges management
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV
N L N N N L L L 5.5 .0050 40.7 —
AFFECTED
Product Versions Fixed
Tourism-Management-System 229956e20dbd4a80eeff14535e44d3099502af09 – —
TIMELINE
Sep 12 Reserved by VulDB
Sep 13 Published (CNA: VulDB)
Sep 14 EXPLOIT PUBLISHED — CVE-2026-90523 (jaychouchannel Tourism-Management-System). Public exploit reference added.
Description
A vulnerability was identified in jaychouchannel Tourism-Management-System up to 229956e20dbd4a80eeff14535e44d3099502af09. The affected element is an unknown function of the file travel/src/main/java/com/controller/UsersController.java of the component User Register Endpoint. Such manipulation of the argument UsersEntity leads to improper privilege management. The attack can be launched remotely. The exploit is publicly available and might be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The name of the patch is 84d8ec384f669df3985293dab293bb7b477efa64. Applying a patch is advised to resolve this issue.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| September 12, 2026 | Reserved | Reserved by VulDB |
| September 13, 2026 | Published | Published (CNA: VulDB) |
| September 14, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-90523 (jaychouchannel Tourism-Management-System). Public exploit reference added. |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| jaychouchannel | Tourism-Management-System | — | 229956e20dbd4a80eeff14535e44d3099502af09 | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-90523 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
