CVE-2026-90939CWE-862broken-access-control

CVE-2026-90939

Medium · published September 14, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
39.0
In the wild
Unconfirmed
What it is

novel-plus through 5.3.3 contains an information disclosure vulnerability in the /sys/user/list endpoint that lacks proper permission annotations. Authenticated attackers can retrieve password hashes and personal data including email addresses and phone numbers for users within their data scope, enabling offline hash cracking and account takeover.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00462 · 39.0th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-09-14T18:17Z
References (6)
https://github.com/201206030/novel-plus · [email protected]https://github.com/201206030/novel-plus/blob/d63c3ee394657046ebd469e263532a350a60e930/novel-admin/src/main/java/com/java2nb/system/controller/SysUserController.java · [email protected]https://github.com/201206030/novel-plus/blob/d63c3ee394657046ebd469e263532a350a60e930/novel-admin/src/main/resources/mybatis/system/UserMapper.xml · [email protected]https://github.com/201206030/novel-plus/releases/tag/v5.3.3 · [email protected]https://github.com/LinYuanyi1/cve-request-poc/blob/master/novel-plus/poc-03-user-list-password-hash-disclosure.py · [email protected]https://www.vulncheck.com/advisories/novel-plus-through-5.3.3-missing-authorization-on-the-admin-sys-user-list-endpoint · [email protected]
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 14 SEP 13:58Z
    novel-plus through 5.3.3 Missing Authorization on the Admin /sys/user/list Endpoint
    cvelistv5