CVE-2026-90939: novel-plus Information Disclosure Flaw

CVE-2026-90939 Overview

CVE-2026-90939 is a missing authorization vulnerability [CWE-862] in novel-plus through version 5.3.3, an open-source novel content management system. The /sys/user/list administrative endpoint lacks proper permission annotations, allowing any authenticated user to enumerate accounts within their data scope. The response includes password hashes, email addresses, and phone numbers. Attackers can use the exposed hashes for offline cracking and leverage recovered credentials for account takeover against privileged accounts.

Critical Impact
Authenticated attackers can retrieve password hashes and personally identifiable information (PII) from the admin user listing endpoint, enabling offline password cracking and subsequent account takeover of higher-privileged users.

Affected Products

novel-plus (all versions through 5.3.3)
novel-admin module SysUserController/sys/user/list endpoint
Deployments exposing the admin backend to untrusted authenticated users

Discovery Timeline

2026-09-14 - CVE-2026-90939 published to the National Vulnerability Database (NVD)
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90939

Vulnerability Analysis

The vulnerability resides in the SysUserController class of the novel-admin module. The /sys/user/list endpoint returns user records but is not protected by the role or permission annotations used elsewhere in the application. Any authenticated session, including low-privileged accounts, can invoke the endpoint and receive the full result set within its data scope.

The backing MyBatis query in UserMapper.xml selects the complete sys_user row, including the password column and sensitive PII fields such as email and mobile. Because the controller does not project a safe data transfer object, hashed credentials are serialized directly into the JSON response.

An attacker with a valid session can automate enumeration of user records and extract password hashes for offline cracking. Recovered plaintext credentials support horizontal or vertical privilege escalation, particularly against administrator accounts reachable from the same endpoint.

Root Cause

The root cause is missing authorization enforcement on a sensitive administrative endpoint combined with over-broad data exposure. The controller method does not declare a @RequiresPermissions annotation, and the persistence layer returns the raw user entity rather than a sanitized view model that excludes credential material.

Attack Vector

Exploitation requires network access to the novel-plus admin interface and any authenticated account. The attacker issues an HTTP request to /sys/user/list, parses the returned JSON, and extracts password, email, and mobile fields for each user in scope. A public proof-of-concept script is available at the GitHub PoC for User List Disclosure.

See the GitHub SysUserController Source and GitHub UserMapper XML Source for the vulnerable code paths.

Detection Methods for CVE-2026-90939

Indicators of Compromise

HTTP requests to /sys/user/list originating from non-administrative user sessions or unusual source addresses.
Bulk or paginated requests iterating the pageNumber parameter against /sys/user/list in a short time window.
Application response payloads exceeding baseline sizes for the endpoint, indicating full-table enumeration.

Detection Strategies

Instrument the novel-admin reverse proxy or application access logs to flag any calls to /sys/user/list from accounts not in the administrator role.
Correlate authentication events with subsequent hits to sensitive /sys/user/* endpoints to identify low-privileged sessions accessing administrative APIs.
Deploy web application firewall (WAF) rules that enforce role-based access to /sys/* routes and alert on violations.

Monitoring Recommendations

Monitor for offline credential-cracking behavior: sudden successful logins to previously dormant privileged accounts following /sys/user/list access.
Track anomalous outbound transfers of JSON payloads from the admin backend to external destinations.
Alert on failed-then-successful authentication chains for administrative users, which can indicate cracked-hash reuse.

How to Mitigate CVE-2026-90939

Immediate Actions Required

Restrict network access to the novel-plus admin interface to trusted management networks only.
Force a password reset for all administrative and privileged accounts, assuming hashes may have been exfiltrated.
Audit access logs for prior requests to /sys/user/list from non-administrative sessions.

Patch Information

No fixed release is identified in the referenced advisory at the time of publication. The vulnerability affects novel-plus through 5.3.3; see the GitHub Release v5.3.3 page and the VulnCheck Advisory for Novel Plus for updates. Track the GitHub Project Repository for future security releases.

Workarounds

Add a @RequiresPermissions("sys:user:list") annotation (or equivalent role check) to the list handler in SysUserController and rebuild the application.
Modify the MyBatis result mapping in UserMapper.xml to exclude the password, email, and mobile columns, or introduce a dedicated data transfer object.
Place the admin backend behind an authenticating reverse proxy that restricts /sys/* paths to administrator group membership.

bash

# Example Nginx restriction for the admin sys endpoints
location ^~ /sys/ {
    allow 10.0.0.0/24;   # trusted admin network
    deny  all;
    proxy_pass http://novel_admin_backend;
}