A flaw in the novel Book Service allows an attacker to manipulate the chapterId parameter and bypass normal authorization checks, enabling retrieval of content that should be restricted. The weakness corresponds to improper authorization and privilege escalation, exposing potentially copyrighted or private material to unauthenticated or low‑privilege users. This could breach confidentiality and undermine content protection.

The vulnerability affects the xxyopen and 201206030 novel applications, specifically versions up to and including 3.5.0. Any deployment of these products that processes book content requests using the BookServiceImpl.getBookContentAbout method is susceptible.

The CVSS score of 6.9 indicates a medium level of severity, and the exploit can be launched remotely. The EPSS score is not available, but the vulnerability is publicly disclosed and may be used in the wild. Because it is not listed in the CISA KEV catalog, there is no formal endorsement of widespread exploitation, yet the moderate risk level and remote attack vector warrant prompt attention.