CVE-2026-90941
novel-plus through 5.3.3 contains an authorization bypass vulnerability in the BookController download endpoint that allows authenticated backend accounts to export complete book text including paid chapters. Attackers can supply a bookId and bookName to retrieve all chapter content without VIP or purchase verification, bypassing the permission checks and data-scope limits enforced elsewhere in the admin interface.
- Published Sep 14, 2026
- CVSS 5.3 medium
- 0.4% chance of exploitation in the next 30 days (EPSS)
- A fix is available