CVE-2026-90941: 201206030 Novel-Plus

Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days.

novel-plus through 5.3.3 contains an authorization bypass vulnerability in the BookController download endpoint that allows authenticated backend accounts to export complete book text including paid chapters. Attackers can supply a bookId and bookName to retrieve all chapter content without VIP or purchase verification, bypassing the permission checks and data-scope limits enforced elsewhere in the admin interface.

Affected products

• 201206030 Novel-Plus: up to and including 5.3.3

Published 2026-09-14. Last modified 2026-09-23.