Vulnerability Description
novel-plus through 5.3.3 contains an information disclosure vulnerability in the /sys/user/list endpoint that lacks proper permission annotations. Authenticated attackers can retrieve password hashes and personal data including email addresses and phone numbers for users within their data scope, enabling offline hash cracking and account takeover.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/201206030/novel-plus
- https://github.com/201206030/novel-plus/blob/d63c3ee394657046ebd469e263532a350a6
- https://github.com/201206030/novel-plus/blob/d63c3ee394657046ebd469e263532a350a6
- https://github.com/201206030/novel-plus/releases/tag/v5.3.3
- https://github.com/LinYuanyi1/cve-request-poc/blob/master/novel-plus/poc-03-user
- https://www.vulncheck.com/advisories/novel-plus-through-5.3.3-missing-authorizat
FAQ
What is CVE-2026-90939?
CVE-2026-90939 is a vulnerability with a CVSS score of 6.5 (MEDIUM). novel-plus through 5.3.3 contains an information disclosure vulnerability in the /sys/user/list endpoint that lacks proper permission annotations. Authenticated attackers can retrieve password hashes ...
How severe is CVE-2026-90939?
CVE-2026-90939 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-90939?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.