CVE-2026-90941: novel-plus Authorization Bypass Vulnerability

CVE-2026-90941 Overview

CVE-2026-90941 is a missing authorization vulnerability [CWE-862] in novel-plus through version 5.3.3. The flaw resides in the BookController download endpoint of the novel-admin module. Any authenticated backend account can export complete book text, including paid chapters, by supplying a bookId and bookName to the download endpoint. The endpoint does not verify VIP status, purchase records, or the data-scope limits enforced elsewhere in the admin interface. This allows low-privileged backend users to bypass paywall controls and exfiltrate premium content.

Critical Impact
Authenticated backend users can download full paid chapter content, resulting in unauthorized disclosure of premium data and loss of paywall revenue.

Affected Products

novel-plus versions up to and including 5.3.3
novel-admin module BookController download endpoint
Deployments exposing the admin interface with backend user accounts

Discovery Timeline

2026-09-14 - CVE-2026-90941 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90941

Vulnerability Analysis

The vulnerability exists in the admin book download endpoint within BookController.java of the novel-admin module. The endpoint accepts a bookId and bookName parameter from authenticated backend users and returns the full chapter text of the requested book. The handler assembles all chapter content, including chapters flagged as VIP or requiring purchase, and streams the aggregated text to the caller.

Other admin views enforce role checks and data-scope limits that restrict what a given operator can access. The download endpoint does not apply those checks. As a result, any account able to authenticate to novel-admin, including least-privileged backend roles, can invoke the endpoint and receive paid content. The response bypasses the front-end purchase and VIP verification implemented in PageController of the novel-front module.

Root Cause

The root cause is a missing authorization check [CWE-862] on the download handler. The controller trusts that authentication alone is sufficient and does not validate whether the caller's role, data scope, or purchase status permits access to paid chapters. There is no server-side gate that maps the requested bookId to the operator's allowed scope.

Attack Vector

Exploitation requires network access to the admin interface and a valid backend account with low privileges. An attacker sends an HTTP request to the book download endpoint with a chosen bookId and bookName. The server responds with the full book text, including chapters that would otherwise require VIP status or per-chapter purchase. A public proof-of-concept demonstrates the request pattern against novel-admin.

Refer to the VulnCheck Advisory on Novel Plus and the GitHub PoC for Novel Plus for the request structure. No verified sanitized exploit snippet is published alongside this advisory.

Detection Methods for CVE-2026-90941

Indicators of Compromise

HTTP requests to the novel-admin book download endpoint carrying bookId and bookName parameters from non-privileged backend accounts.
Large or repeated responses containing concatenated chapter text originating from the admin download handler.
Backend accounts downloading books outside their assigned data scope or role.

Detection Strategies

Review web server and application access logs for unexpected calls to the admin book download route from user roles that should not perform bulk exports.
Correlate download activity with account privilege tier to identify low-privileged operators exporting paid content.
Alert on high-volume enumeration of sequential bookId values from a single session.

Monitoring Recommendations

Enable verbose access logging on the novel-admin module and forward logs to a central analytics platform.
Track per-user download counts and response sizes against baselines for the admin download endpoint.
Monitor for authenticated sessions issuing requests outside normal working hours or from unexpected source IPs.

How to Mitigate CVE-2026-90941

Immediate Actions Required

Restrict network access to the novel-admin interface to trusted administrative networks only.
Audit existing backend accounts and disable or downgrade accounts that do not require book export privileges.
Rotate credentials for any backend account suspected of misuse and review recent download activity.

Patch Information

At the time of publication, the advisory identifies novel-plus through 5.3.3 as affected. Consult the GitHub Repository for Novel Plus and the GitHub Release v5.3.3 page for updated releases and commits addressing the missing authorization check in BookController.

Workarounds

Add a server-side authorization check to the book download handler that validates the caller's role and data scope before returning chapter content.
Enforce VIP and purchase verification for paid chapters in the admin download path, mirroring the checks in PageController of novel-front.
Place the admin interface behind a reverse proxy that requires additional authentication or IP allowlisting.
Remove or disable the admin download endpoint if it is not required for business operations.

bash

# Example reverse proxy allowlist for the novel-admin interface (nginx)
location /novel-admin/ {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://novel_admin_backend;
}