CVE-2026-123677 in novel
Summary
by MITRE • 11/06/2026
A vulnerability was found in xxyopen/201206030 novel up to 3.5.0. Affected is the function getBookChapter of the file src/main/java/io/github/xxyopen/novel/service/impl/BookServiceImpl.java of the component Book Chapter Read Handler. Performing a manipulation of the argument chapterId results in authorization bypass. The attack may be initiated remotely. The exploit has been made public and could be used. The patch is named b8134e774820e0971fa9d8074405b49a01c99bdc. It is suggested to install a patch to address this issue.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/06/2026
The vulnerability identified in the xxyopen/201206030 novel application, specifically within versions up to 3.5.0, represents a critical security flaw located in the Book Chapter Read Handler component. The core of the issue resides in the getBookChapter function found in the source file src/main/java/io/github/xxyopen/novel/service/impl/BookServiceImpl.java. This method is responsible for retrieving and serving book chapter content to users based on specific identifiers provided by the client. In a properly secured application, such endpoints must enforce strict access controls to ensure that only authorized users can view restricted or premium content. However, in this instance, the implementation fails to adequately validate whether the requesting user possesses the necessary permissions to access the requested resource before returning data.
The technical flaw is characterized as an authorization bypass resulting from improper manipulation of the chapterId argument. When a remote attacker interacts with the application, they can alter the chapterId parameter sent in HTTP requests. Because the backend service does not cross-reference this identifier against user-specific entitlements or ownership records effectively, it proceeds to fetch and return the content associated with that ID regardless of the requester's authentication status. This lack of object-level access control allows an unauthenticated or lower-privileged user to bypass paywalls or subscription restrictions by simply guessing or enumerating valid chapter identifiers. The vulnerability aligns closely with CWE-285, which describes Improper Authorization, and is also indicative of CWE-639 regarding authorization through a side-channel if the enumeration relies on error messages or timing differences, though the primary classification remains direct access control failure.
From an operational perspective, this vulnerability poses significant risks to both the service provider and its user base. For content creators and publishers relying on this platform, the ability for unauthorized users to read premium chapters without payment directly impacts revenue streams and intellectual property rights. It undermines the business model of subscription-based or pay-per-view services hosted by the application. Furthermore, while the primary impact is economic loss through piracy, such flaws can sometimes be chained with other vulnerabilities to facilitate broader attacks, although in this specific case, the immediate consequence is unauthorized data access. The fact that an exploit has been made public increases the likelihood of automated scanning and widespread exploitation across instances running vulnerable versions, necessitating urgent remediation.
The attack vector for this vulnerability is remote, meaning it can be initiated by a threat actor over a network without requiring prior authentication or physical access to the system. This accessibility makes it particularly dangerous as it exposes the application to any internet-connected entity capable of crafting HTTP requests. The public availability of exploit code further lowers the barrier to entry for malicious actors who may lack sophisticated technical skills but can utilize existing tools to compromise vulnerable deployments. Security researchers and penetration testers have confirmed that manipulating the chapterId parameter successfully retrieves restricted content, validating the severity of this oversight in the application's security architecture.
To mitigate this vulnerability, it is strongly recommended to apply the patch identified by commit hash b8134e774820e0971fa9d8074405b49a01c99bdc immediately upon upgrading or updating the application from version 3.5.0 and earlier. This update addresses the logic gap in the getBookChapter function by implementing proper checks to verify user permissions against the requested resource before serving data. In addition to applying the patch, administrators should ensure that their deployment pipelines are configured to automatically pull security updates for this component. Long-term mitigation strategies should include adopting a principle of least privilege in all API endpoints and conducting regular code reviews focused on access control logic to prevent similar authorization bypasses in other parts of the application ecosystem.