CVE-2026-90941
MediumCVSS 4.3Summary
novel-plus through 5.3.3 contains an authorization bypass vulnerability in the BookController download endpoint that allows authenticated backend accounts to export complete book text including paid chapters. Attackers can supply a bookId and bookName to retrieve all chapter content without VIP or purchase verification, bypassing the permission checks and data-scope limits enforced elsewhere in the admin interface.
Risk Assessment
An attacker with a backend account can access paid content without paying, leading to financial loss and business integrity compromise.
Recommendation
Update novel-plus to a patched version or implement custom authorization checks on the download endpoint, requiring VIP and purchase verification.
Other vulnerabilities in novel-plus
See all- CVE-2026-90940Medium
novel-plus through 5.3.3 contains an insecure default cache-management password in the CacheController.refreshCache endpoint that allows anonymous attackers to invalidate portal caches by supplying the hardcoded default value in the URL path. Attackers can trigger unauthorized cache invalidation by accessing the cache/refresh endpoint with the known default password, forcing unnecessary database queries to repopulate the cache.
- CVE-2026-90939Medium
novel-plus through 5.3.3 contains an information disclosure vulnerability in the /sys/user/list endpoint that lacks proper permission annotations. Authenticated attackers can retrieve password hashes and personal data including email addresses and phone numbers for users within their data scope, enabling offline hash cracking and account takeover.
- CVE-2023-37847Critical
A SQL injection vulnerability was discovered in novel-plus version 3.6.2. This flaw could allow an attacker to manipulate database queries.
Original NVD description (English source)
novel-plus through 5.3.3 contains an authorization bypass vulnerability in the BookController download endpoint that allows authenticated backend accounts to export complete book text including paid chapters. Attackers can supply a bookId and bookName to retrieve all chapter content without VIP or purchase verification, bypassing the permission checks and data-scope limits enforced elsewhere in the admin interface.