CVE-2026-90941— novel-plus through 5.3.3 Missing Authorization on the Admin Book Download Endpoint
Quick assessment
Affected
201206030 novel-plus
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Novel-Plus 5.3.3 及之前版本在 BookController 的下载端点中存在一个授权绕过漏洞，允许已认证的后端账户导出完整的书籍文本，包括付费章节。攻击者只需提供 bookId 和 bookName 即可获取所有章节内容，无需 VIP 或购买验证，从而绕过了管理界面其他位置所执行的权限检查和数据范围限制。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-90941
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
novel-plus through 5.3.3 Missing Authorization on the Admin Book Download Endpoint
Source: CVE Program / CVE List V5
Vulnerability Description
novel-plus through 5.3.3 contains an authorization bypass vulnerability in the BookController download endpoint that allows authenticated backend accounts to export complete book text including paid chapters. Attackers can supply a bookId and bookName to retrieve all chapter content without VIP or purchase verification, bypassing the permission checks and data-scope limits enforced elsewhere in the admin interface.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| 201206030 | novel-plus | 0 ~ 5.3.3 | - |
|
II. Public POCs for CVE-2026-90941
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-90941
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-90941 (2)
Vendor Advisories for CVE-2026-90941 (1)
Proof of Concept for CVE-2026-90941 (1)
Vendor Pages for CVE-2026-90941 (1)
Other References for CVE-2026-90941 (1)
Same Patch Batch · 201206030 · 2026-09-14 · 3 CVEs total
| CVE-2026-90939 | 6.5 MEDIUM | novel-plus through 5.3.3 Missing Authorization on the Admin /sys/user/list Endpoint |
| CVE-2026-90940 | 5.3 MEDIUM | novel-plus through 5.3.3 Default Cache Management Password in the Front Portal |
IV. Related Vulnerabilities
Same product: novel-plus
-
CVE-2026-90940
novel-plus through 5.3.3 Default Cache Management Password i -
CVE-2026-90939
novel-plus through 5.3.3 Missing Authorization on the Admin -
CVE-2025-6535
xxyopen/201206030 novel-plus User Management Module UserMapp -
CVE-2025-6534
xxyopen/201206030 novel-plus File FileController.java remove -
CVE-2025-6533
xxyopen/201206030 novel-plus CATCHA LoginController.java aja
Same vendor: 201206030
-
CVE-2026-90940
novel-plus through 5.3.3 Default Cache Management Password i -
CVE-2026-90939
novel-plus through 5.3.3 Missing Authorization on the Admin -
CVE-2025-4036
201206030 Novel Chapter AuthorController.java updateBookChap -
CVE-2025-3956
201206030 novel-cloud BookInfoMapper.xml RestResp sql inject
Same weakness: CWE-862
-
CVE-2026-82437
Apache Storm Logviewer: Log Access Controls Not Enforced by -
CVE-2026-90939
novel-plus through 5.3.3 Missing Authorization on the Admin -
CVE-2026-75030
Apache Syncope: Incomplete authorization checks for Group me -
CVE-2026-90933
laradashboard through 1.2.2 Missing Authorization via Licens -
CVE-2026-8821
Playbooks run owner channel membership permission bypass
V. Comments for CVE-2026-90941
No comments yet