CVE-2026-90939
novel-plus through 5.3.3 Missing Authorization on the Admin /sys/user/list Endpoint
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
novel-plus through 5.3.3 contains an information disclosure vulnerability in the /sys/user/list endpoint that lacks proper permission annotations. Authenticated attackers can retrieve password hashes and personal data including email addresses and phone numbers for users within their data scope, enabling offline hash cracking and account takeover.
| CWE | CWE-862 |
| Vendor | 201206030 |
| Product | novel-plus |
| Published | Sep 14, 2026 |
| Last Updated | Sep 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for 201206030 novel-plus
Be the first to know when new medium vulnerabilities affecting 201206030 novel-plus are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
201206030 / novel-plus
0 ≤ 5.3.3
References
github.com: https://github.com/LinYuanyi1/cve-request-poc/blob/master/novel-plus/poc-03-user-list-password-hash-disclosure.py github.com: https://github.com/201206030/novel-plus/blob/d63c3ee394657046ebd469e263532a350a60e930/novel-admin/src/main/java/com/java2nb/system/controller/SysUserController.java github.com: https://github.com/201206030/novel-plus/blob/d63c3ee394657046ebd469e263532a350a60e930/novel-admin/src/main/resources/mybatis/system/UserMapper.xml github.com: https://github.com/201206030/novel-plus/releases/tag/v5.3.3 github.com: https://github.com/201206030/novel-plus vulncheck.com: https://www.vulncheck.com/advisories/novel-plus-through-5.3.3-missing-authorization-on-the-admin-sys-user-list-endpoint
Credits
🔍 Mingsheng Lin