CVE-2026-90939 in novel-plus
Summary
by MITRE • 09/14/2026
novel-plus through 5.3.3 contains an information disclosure vulnerability in the /sys/user/list endpoint that lacks proper permission annotations. Authenticated attackers can retrieve password hashes and personal data including email addresses and phone numbers for users within their data scope, enabling offline hash cracking and account takeover.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/14/2026
The security flaw identified in novel-plus versions up to 5.3.3 represents a critical failure in access control mechanisms, specifically categorized under CWE-284 Improper Access Control. This vulnerability resides within the /sys/user/list API endpoint, which is designed to return user information for administrative or management purposes. The core technical deficiency lies in the absence of proper permission annotations on this endpoint, meaning that while authentication is required to access it, there are no sufficient authorization checks to verify whether the authenticated user has the specific privileges necessary to view sensitive data belonging to other users within their scope. This oversight allows any validly authenticated attacker who falls within a defined data scope to bypass intended restrictions and retrieve comprehensive details about other accounts.
The operational impact of this vulnerability is severe due to the nature of the exposed data. The endpoint returns password hashes alongside personally identifiable information such as email addresses and phone numbers. While the exposure of personal data constitutes a privacy violation, the disclosure of password hashes presents an immediate and direct threat to account security. Attackers can leverage these hashes in offline cracking attacks using tools like Hashcat or John the Ripper. Given that many users still employ weak or reused passwords across multiple services, successful cracking is highly probable. Once credentials are compromised, attackers gain unauthorized access to user accounts, leading to potential data theft, manipulation of records, and further lateral movement within the application ecosystem if those accounts have elevated privileges.
From a threat modeling perspective, this vulnerability aligns with ATT&CK technique T1078 Valid Accounts, as it relies on legitimate credentials to exploit misconfigured permissions. It also relates to CWE-200 Information Exposure, where sensitive system information is made available to unauthorized actors. The lack of granular role-based access control or object-level permission checks means that the application fails to enforce the principle of least privilege effectively. This type of flaw often arises during development when developers assume that general authentication is sufficient for all endpoints without implementing specific authorization logic tailored to each resource's sensitivity level.
To mitigate this vulnerability, immediate remediation should focus on enforcing strict access controls at the API layer. Developers must implement robust permission annotations or middleware checks that verify not only that a user is authenticated but also that they possess the explicit role or privilege required to list users in the requested scope. Additionally, input validation and output filtering should be applied to ensure that sensitive fields like password hashes are never included in standard response payloads unless absolutely necessary for specific administrative functions, and even then, access must be tightly restricted to super-administrators only. Regular security audits and static application security testing can help identify similar misconfigurations before deployment.