CVE-2026-90941 201206030 CVE debrief

Who should care

Authenticated administrators and users of novel-plus should assess exposure and apply patches if available to prevent unauthorized access to book content. This includes verifying and restricting access to the BookController download endpoint, reviewing compensating controls for exposed systems, and monitoring for unauthorized access to book content.

Why it matters

The authorization bypass vulnerability in novel-plus through 5.3.3 allows authenticated backend accounts to export complete book text including paid chapters, which could lead to unauthorized access to sensitive content.

• Authenticated administrators need to verify and restrict access to the BookController download endpoint
• Exposure could lead to unauthorized export of book content, including paid chapters
• Defenders should assess and apply patches if available to prevent exploitation
• Verification of user access controls and data-scope limits is necessary

Technical summary

The BookController download endpoint in novel-plus through 5.3.3 contains an authorization bypass vulnerability that allows authenticated backend accounts to export complete book text, including paid chapters. This vulnerability enables attackers to bypass permission checks and data-scope limits, potentially leading to unauthorized access to sensitive content. The issue affects authenticated administrators and users, who should assess exposure and apply patches if available to prevent exploitation and unauthorized access.

Defensive priority

Authenticated administrators should verify and restrict access to the BookController download endpoint, assess exposure, and apply patches if available.

Recommended defensive actions

• Verify and restrict access to the BookController download endpoint
• Assess exposure and apply patches if available
• Monitor for unauthorized access to book content
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the authorization bypass vulnerability in novel-plus through 5.3.3. Evidence is limited to public sources and may not cover all affected deployments or variations. Defenders should verify and restrict access to the BookController download endpoint, assess exposure, and apply patches if available to prevent exploitation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.