Description

A vulnerability was found in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132. This issue affects some unknown processing of the file MenpiaodingdanController.java of the component CRUD. The manipulation of the argument ID results in authorization bypass. It is possible to launch the attack remotely. The exploit has been made public and could be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The patch is identified as d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86. It is best practice to apply a patch to resolve this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-13T13:16:28.927Z",
  "pubdate": "2026-09-13T13:16:28.927Z",
  "executiveSummary": "A critical authorization bypass vulnerability has been identified in the Tourism-Management-System repository, specifically within the MenpiaodingdanController.java component.\nThis vulnerability allows an unauthenticated or unauthorized remote attacker to manipulate the 'ID' argument, potentially gaining unauthorized access to sensitive data or functionality associated with the CRUD operations.\nThe flaw affects versions of the product up to commit 8122bf020d91199eddfff3ee02d1632a70a9a132.\nGiven that the exploit is publicly available, the risk of exploitation is high. Successful exploitation enables unauthorized interaction with backend systems, which could lead to significant data breaches or integrity compromise within the tourism management framework.\nImmediate application of the provided security patch is necessary to neutralize this threat, as the system utilizes a rolling release model, necessitating proactive maintenance.",
  "technicalDetails": "The vulnerability resides in the MenpiaodingdanController.java file, which serves as a controller component for handling CRUD (Create, Read, Update, Delete) operations within the Tourism-Management-System. The root cause of this authorization bypass is an insecure implementation of access control checks on the input parameter 'ID'.\nIn a secure implementation, an application must validate that the authenticated user possesses the necessary privileges to perform actions on a specific resource identified by an ID. In this instance, the controller fails to adequately verify the requester's authorization level or ownership of the resource associated with the provided ID before executing requested operations. Consequently, an attacker can craft malicious requests by manipulating the ID parameter to bypass existing access restrictions.\nThe attack flow proceeds as follows: An attacker identifies the target endpoint mapped to MenpiaodingdanController.java. By sending a crafted HTTP request (e.g., GET, POST, PUT, or DELETE) to the endpoint, the attacker injects an arbitrary or targeted ID value into the request parameters. Because the server-side code performs insufficient authorization validation, the application processes the request as if it were authorized, granting the attacker access to, or control over, the specified resource.\nThis vulnerability is remotely exploitable, requiring no prior authentication or specific privileges, depending on the implementation details. Since the exploit is already public, automated scanners and threat actors can easily leverage this weakness to target exposed instances of the application. The scope of impact includes unauthorized data access, unauthorized modification of records, and potential disruption of service within the affected tourism management environment.\nAffected versions are identified as those leading up to commit hash 8122bf020d91199eddfff3ee02d1632a70a9a132. The vulnerability is specifically addressed by the patch identified by commit d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86, which likely introduces proper authorization checks, ensuring that user sessions are mapped correctly to resource identifiers during request handling."
}