CVE-2026-90939 201206030 CVE debrief

Who should care

Defenders and security teams responsible for systems using novel-plus 5.3.3 or earlier should assess exposure and implement mitigations to prevent potential account takeover and offline hash cracking.

Why it matters

CVE-2026-90939 is a high-severity information disclosure vulnerability in novel-plus 5.3.3 that allows authenticated attackers to access sensitive user data, potentially leading to account takeover and offline hash cracking. Defenders should prioritize verifying exposure, implementing compensating controls, and monitoring for potential attacks.

• Authenticated attackers can retrieve password hashes for offline cracking.
• Personal data such as email addresses and phone numbers can be accessed.
• Potential account takeover is possible if hashes are cracked.
• Defenders need to verify exposure and implement compensating controls.

Technical summary

The /sys/user/list endpoint in novel-plus through 5.3.3 lacks proper permission annotations, allowing authenticated attackers to retrieve sensitive user data, including password hashes, email addresses, and phone numbers. This vulnerability has a CVSS score of 7.1 and is classified as HIGH severity. The vulnerability allows offline hash cracking and potential account takeover, emphasizing the need for defenders to verify exposure and implement compensating controls. The affected product is novel-plus, and the vulnerability is publicly known.

Defensive priority

Defenders should prioritize verifying exposure and implementing compensating controls, as the vulnerability allows offline hash cracking and potential account takeover.

Recommended defensive actions

• Verify if systems using novel-plus 5.3.3 or earlier are exposed and within an attacker's potential data scope.
• Implement compensating controls such as additional authentication or access controls for the /sys/user/list endpoint.
• Monitor for and respond to potential offline hash cracking attempts.
• Consider upgrading to a version of novel-plus that addresses this vulnerability.
• Review relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but vendor statements and additional impact assessments are limited. The vulnerability affects novel-plus versions up to 5.3.3. There are no known exploits, but defenders should verify exposure and implement compensating controls. Evidence is based on CVE and NVD data, with limited additional context from other sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.