CVE-2026-90524: jaychouchannel Tourism-Management-System Update Endpoint missing authentication
A security flaw has been discovered in jaychouchannel Tourism-Management-System up to 229956e20dbd4a80eeff14535e44d3099502af09. The impacted element is an unknown function of the component Update Endpoint. Performing a manipulation results in missing authentication. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The patch is named 84d8ec384f669df3985293dab293bb7b477efa64. It is suggested to install a patch to address this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
jaychouchannel Tourism-Management-System (Update Endpoint)to a version that resolves this vulnerability.Patch 84d8ec384f669df3985293dab293bb7b477efa64
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker can initiate the attack without privileges or user interaction. Public exploit code has been released, which increases the likelihood of exploitation attempts.
What impact should be expected if exploitation succeeds?
The available severity data indicates low impacts to confidentiality, integrity, and availability. The vulnerability is rated high with a CVSS score of 7.3.
How can I determine whether my deployment is affected?
Deployments containing code up to commit 229956e20dbd4a80eeff14535e44d3099502af09 are affected. Because the product uses a rolling release model, version numbers are not available for determining exposure.
What remediation is available?
Install the patch identified by commit 84d8ec384f669df3985293dab293bb7b477efa64. The provided information does not specify an alternative mitigation when patching cannot be performed immediately.