CVE-2026-90939
novel-plus through 5.3.3 Missing Authorization on the Admin /sys/user/list Endpoint
- State
- Published
- Severity
- 7.1 High
- Published
- Sep 14, 2026
- Updated
- Sep 24, 2026
- Reserved
- Sep 14, 2026
Description
novel-plus through 5.3.3 contains an information disclosure vulnerability in the /sys/user/list endpoint that lacks proper permission annotations. Authenticated attackers can retrieve password hashes and personal data including email addresses and phone numbers for users within their data scope, enabling offline hash cracking and account takeover.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
novel-plus201206030 |
|
References
- GET /sys/user/list password hash disclosure proof of conceptexploit
- SysUserController.list carries no @RequiresPermissions while the sibling page method doestechnical-description
- UserMapper.xml list and listByPerm both select the password columntechnical-description
- novel-plus v5.3.3 Release Notesrelease-notes
- Productproduct
- VulnCheck Advisory: novel-plus through 5.3.3 Missing Authorization on the Admin /sys/user/list Endpointthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.