Description

A vulnerability was identified in jaychouchannel Tourism-Management-System up to 229956e20dbd4a80eeff14535e44d3099502af09. The affected element is an unknown function of the file travel/src/main/java/com/controller/UsersController.java of the component User Register Endpoint. Such manipulation of the argument UsersEntity leads to improper privilege management. The attack can be launched remotely. The exploit is publicly available and might be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The name of the patch is 84d8ec384f669df3985293dab293bb7b477efa64. Applying a patch is advised to resolve this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-13T14:16:49.337Z",
  "pubdate": "2026-09-13T14:16:49.337Z",
  "executiveSummary": "A critical vulnerability related to improper privilege management exists within the Tourism-Management-System's User Register endpoint.\nThe flaw resides in the handling of the UsersEntity object within the UsersController.java file.\nThis vulnerability allows remote, unauthenticated attackers to manipulate user account attributes during the registration process, potentially leading to unauthorized privilege escalation.\nBy injecting specific properties into the UsersEntity during submission, an attacker can circumvent standard authorization logic.\nThe risk is categorized as high due to the potential for unauthorized administrative access and the availability of public exploits, posing a significant threat to system integrity and confidentiality.\nAffected systems include the Tourism-Management-System up to commit 229956e20dbd4a80eeff14535e44d3099502af09.",
  "technicalDetails": "The vulnerability originates from insecure data binding within the User Register endpoint, specifically located in travel/src/main/java/com/controller/UsersController.java.\nThe application processes the UsersEntity object without properly filtering or sanitizing incoming request parameters, enabling mass assignment vulnerabilities.\nDuring the registration flow, the controller maps HTTP request parameters directly to the fields of the UsersEntity object. If the application exposes privilege-related fields (such as 'role', 'isAdmin', or 'permissions') within the entity, an attacker can inject these fields into the POST request body.\nThe exploitation process follows a sequential pattern: first, the attacker identifies the parameter names mapped to the internal UsersEntity class. Second, the attacker crafts a malicious request to the registration endpoint, including these sensitive fields with escalated values. Third, the application's underlying persistence layer accepts these forged attributes and saves the new user record into the database with elevated privileges.\nBecause the registration endpoint is typically accessible without pre-existing credentials, the attack vector is fully remote and does not require prior authentication. Once the attacker successfully creates an account with administrative or elevated status, they can access restricted system functions, modify system settings, or manipulate data belonging to other users.\nThis behavior constitutes a classic failure to enforce least privilege during object construction. The application fails to strictly define a Data Transfer Object (DTO) or utilize appropriate whitelist validation to ensure that only intended user-provided input is accepted during the registration phase.\nThe technical impact is severe, as it facilitates a complete compromise of the identity and access management (IAM) layer within the Tourism-Management-System. The absence of versioning makes tracking affected builds difficult; however, the presence of public exploit material necessitates immediate intervention to prevent unauthorized account creation with elevated permissions.\nThe vulnerability remains active in all versions up to the commit hash 229956e20dbd4a80eeff14535e44d3099502af09."
}