CVE-2026-90939

novel-plus through 5.3.3 Missing Authorization on the Admin /sys/user/list Endpoint

Published Sep 14, 2026 CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Description

novel-plus through 5.3.3 contains an information disclosure vulnerability in the /sys/user/list endpoint that lacks proper permission annotations. Authenticated attackers can retrieve password hashes and personal data including email addresses and phone numbers for users within their data scope, enabling offline hash cracking and account takeover.

Analysis

Technical impact

The flaw is caused by missing permission annotations on the /sys/user/list endpoint in novel-plus up to version 5.3.3. An authenticated user can invoke this endpoint and receive password hashes as well as personal data such as email addresses and phone numbers. The weakness is classified as CWE-862, indicating insufficient authorization checks. The immediate effect is that an attacker can acquire credential material for offline hash cracking and potentially takeover user accounts.

Affected Systems

The vulnerable product is novel-plus, released by 201206030. The issue exists in all releases up to and including version 5.3.3. Attempts to run the endpoint in later versions are unaffected once the patch has been applied.

Risk and Exploitability

The CVSS score of 7.1 places the vulnerability in the medium‑high and the flaw is not listed in the CISA KEV catalog. Because the attack requires only valid authentication and does not need elevated privileges, any authenticated user with access to the system can exploit it. The resulting data exposure facilitates offline password cracking and enables account takeover.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

201206030

novel-plus

unaffected

Version	Status	Constraints
`0`	affected	≤ 5.3.3

No data.

Vendor Product Versions

Xxyopen

Novel-plus

Version	Status	Scheme	Platform
`[0,*]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest novel‑plus patch that adds proper authorization checks to the /sys/user/list endpoint.
If a patch is not yet available, restrict access to the /sys/user/list endpoint so that only administrators can call it, for example by implementing role‑based access control or network‑level restrictions.
Perform a code audit of all exposed endpoints to verify that authorization checks are correctly applied and that no other sensitive data is inadvertently exposed to authenticated users.

Generated by OpenCVE AI on September 15, 2026 at 13:48 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.462% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/201206030/novel-plus
https://github.com/201206030/novel-plus/blob/d63c3ee394657046ebd469e263532a350a60e930/novel-admin/src/main/java/com/java2nb/system/controller/SysUserController.java
https://github.com/201206030/novel-plus/blob/d63c3ee394657046ebd469e263532a350a60e930/novel-admin/src/main/resources/mybatis/system/UserMapper.xml
https://github.com/201206030/novel-plus/releases/tag/v5.3.3
https://github.com/LinYuanyi1/cve-request-poc/blob/master/novel-plus/poc-03-user-list-password-hash-disclosure.py
https://www.vulncheck.com/advisories/novel-plus-through-5.3.3-missing-authorization-on-the-admin-sys-user-list-endpoint

History

Sep 14, 2026 9:00 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 14, 2026 2:15 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		novel-plus through 5.3.3 contains an information disclosure vulnerability in the /sys/user/list endpoint that lacks proper permission annotations. Authenticated attackers can retrieve password hashes and personal data including email addresses and phone numbers for users within their data scope, enabling offline hash cracking and account takeover.
Title		novel-plus through 5.3.3 Missing Authorization on the Admin /sys/user/list Endpoint
First Time appeared		Xxyopen Xxyopen novel-plus
Weaknesses		CWE-862
CPEs		cpe:2.3:a:xxyopen:novel-plus::::::::
Vendors & Products		Xxyopen Xxyopen novel-plus
References		https://github.com/201206030/novel-plus https://github.com/201206030/novel-plus/blob/d63c3ee394657046ebd469e263532a350a60e930/novel-admin/src/main/java/com/java2nb/system/controller/SysUserController.java https://github.com/201206030/novel-plus/blob/d63c3ee394657046ebd469e263532a350a60e930/novel-admin/src/main/resources/mybatis/system/UserMapper.xml https://github.com/201206030/novel-plus/releases/tag/v5.3.3 https://github.com/LinYuanyi1/cve-request-poc/blob/master/novel-plus/poc-03-user-list-password-hash-disclosure.py https://www.vulncheck.com/advisories/novel-plus-through-5.3.3-missing-authorization-on-the-admin-sys-user-list-endpoint
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}` cvssV4_0 `{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}`