Vulnerability · Published Sep 14, 2026 · Assigned by VulnCheck

CVE-2026-90940novel-plus through 5.3.3 Default Cache Management Password in the Front Portal

Medium 5.3

In plain English

A medium-severity security flaw in novel-plus from 201206030. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.5%top 54.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

novel-plus through 5.3.3 contains an insecure default cache-management password in the CacheController.refreshCache endpoint that allows anonymous attackers to invalidate portal caches by supplying the hardcoded default value in the URL path. Attackers can trigger unauthorized cache invalidation by accessing the cache/refresh endpoint with the known default password, forcing unnecessary database queries to repopulate the cache.

Affected products (as reported)

Vendor	Product	Versions
201206030	novel-plus	0 – through 5.3.3

Weakness: CWE-1392 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

Anonymous cache refresh with the repository password proof of concept exploit
CacheController.refreshCache authorizes on a string comparison in the method body technical-description
application.yml ships the cache.manager.password default value technical-description
novel-plus v5.3.3 Release Notes release-notes
Product product
VulnCheck Advisory: novel-plus through 5.3.3 Default Cache Management Password in the Front Portal third-party-advisory