Medium severity6.5NVD Advisory· Published Sep 14, 2026· Updated Sep 14, 2026
CVE-2026-90939
CVE-2026-90939
Description
novel-plus through 5.3.3 contains an information disclosure vulnerability in the /sys/user/list endpoint that lacks proper permission annotations. Authenticated attackers can retrieve password hashes and personal data including email addresses and phone numbers for users within their data scope, enabling offline hash cracking and account takeover.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
5- github.com/201206030/novel-plus/blob/d63c3ee394657046ebd469e263532a350a60e930/novel-admin/src/main/java/com/java2nb/system/controller/SysUserController.javanvd
- github.com/201206030/novel-plus/blob/d63c3ee394657046ebd469e263532a350a60e930/novel-admin/src/main/resources/mybatis/system/UserMapper.xmlnvd
- github.com/201206030/novel-plus/releases/tag/v5.3.3nvd
- github.com/LinYuanyi1/cve-request-poc/blob/master/novel-plus/poc-03-user-list-password-hash-disclosure.pynvd
- www.vulncheck.com/advisories/novel-plus-through-5.3.3-missing-authorization-on-the-admin-sys-user-list-endpointnvd
News mentions
0No linked articles in our index yet.