Vulnerability · Published Sep 14, 2026 · Assigned by VulnCheck

CVE-2026-90941novel-plus through 5.3.3 Missing Authorization on the Admin Book Download Endpoint

Medium 4.3

In plain English

A medium-severity missing authorization in novel-plus from 201206030. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.4%top 64.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

novel-plus through 5.3.3 contains an authorization bypass vulnerability in the BookController download endpoint that allows authenticated backend accounts to export complete book text including paid chapters. Attackers can supply a bookId and bookName to retrieve all chapter content without VIP or purchase verification, bypassing the permission checks and data-scope limits enforced elsewhere in the admin interface.

Affected products (as reported)

Vendor	Product	Versions
201206030	novel-plus	0 – through 5.3.3

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

GET /novel/book/download missing authorization proof of concept exploit
BookController.download is the only one of nine methods without @RequiresPermissions technical-description
The reader portal gates paid chapters behind a needBuy purchase check that the admin download endpoint omits technical-description
novel-plus v5.3.3 Release Notes release-notes
Product product
VulnCheck Advisory: novel-plus through 5.3.3 Missing Authorization on the Admin Book Download Endpoint third-party-advisory