CVE-2026-90940
novel-plus through 5.3.3 Default Cache Management Password in the Front Portal
- State
- Published
- Severity
- 6.9 Medium
- Published
- Sep 14, 2026
- Updated
- Sep 24, 2026
- Reserved
- Sep 14, 2026
Description
novel-plus through 5.3.3 contains an insecure default cache-management password in the CacheController.refreshCache endpoint that allows anonymous attackers to invalidate portal caches by supplying the hardcoded default value in the URL path. Attackers can trigger unauthorized cache invalidation by accessing the cache/refresh endpoint with the known default password, forcing unnecessary database queries to repopulate the cache.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L | VulnCheck |
Weaknesses
- CWE-1392 Use of Default Credentials
Affected Products
| Product | Versions |
|---|---|
novel-plus201206030 |
|
References
- Anonymous cache refresh with the repository password proof of conceptexploit
- CacheController.refreshCache authorizes on a string comparison in the method bodytechnical-description
- application.yml ships the cache.manager.password default valuetechnical-description
- novel-plus v5.3.3 Release Notesrelease-notes
- Productproduct
- VulnCheck Advisory: novel-plus through 5.3.3 Default Cache Management Password in the Front Portalthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.