CVE-2026-90939
MediumCVSS 6.5Summary
novel-plus through 5.3.3 contains an information disclosure vulnerability in the /sys/user/list endpoint that lacks proper permission annotations. Authenticated attackers can retrieve password hashes and personal data including email addresses and phone numbers for users within their data scope, enabling offline hash cracking and account takeover.
Risk Assessment
Exposure of password hashes and personal data can lead to account takeover, privacy violations, and potential phishing attacks.
Recommendation
Update novel-plus to a version that adds proper access controls for this endpoint or restrict access to authorized roles only. Additionally, enforce strong passwords and consider forcing password resets for affected accounts.
Other vulnerabilities in novel-plus
See all- CVE-2026-90941Medium
novel-plus through 5.3.3 contains an authorization bypass vulnerability in the BookController download endpoint that allows authenticated backend accounts to export complete book text including paid chapters. Attackers can supply a bookId and bookName to retrieve all chapter content without VIP or purchase verification, bypassing the permission checks and data-scope limits enforced elsewhere in the admin interface.
- CVE-2026-90940Medium
novel-plus through 5.3.3 contains an insecure default cache-management password in the CacheController.refreshCache endpoint that allows anonymous attackers to invalidate portal caches by supplying the hardcoded default value in the URL path. Attackers can trigger unauthorized cache invalidation by accessing the cache/refresh endpoint with the known default password, forcing unnecessary database queries to repopulate the cache.
- CVE-2023-37847Critical
A SQL injection vulnerability was discovered in novel-plus version 3.6.2. This flaw could allow an attacker to manipulate database queries.
Original NVD description (English source)
novel-plus through 5.3.3 contains an information disclosure vulnerability in the /sys/user/list endpoint that lacks proper permission annotations. Authenticated attackers can retrieve password hashes and personal data including email addresses and phone numbers for users within their data scope, enabling offline hash cracking and account takeover.