CVE-2026-90941 in novel-plus
Summary
by MITRE • 09/14/2026
novel-plus through 5.3.3 contains an authorization bypass vulnerability in the BookController download endpoint that allows authenticated backend accounts to export complete book text including paid chapters. Attackers can supply a bookId and bookName to retrieve all chapter content without VIP or purchase verification, bypassing the permission checks and data-scope limits enforced elsewhere in the admin interface.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/14/2026
The vulnerability identified within Novel-Plus versions up to 5.3.3 represents a critical authorization bypass flaw located specifically in the BookController download endpoint. This security defect allows authenticated backend accounts, which typically possess elevated privileges for administrative tasks, to circumvent standard access controls designed to protect premium content. The core technical issue stems from an insufficient verification mechanism within this specific API route. While other parts of the admin interface correctly enforce permission checks and data-scope limits that restrict users based on their subscription status or purchase history, the download endpoint fails to replicate these safeguards. Consequently, when an attacker supplies a valid bookId and bookName parameter, the system retrieves and returns the complete text content of the specified book without performing any validation regarding VIP status or prior purchases. This inconsistency in security logic creates a direct path for unauthorized data exfiltration, effectively nullifying the paywall protections intended to safeguard intellectual property and revenue streams associated with paid chapters.
From an operational perspective, this vulnerability poses significant risks to both content creators and platform operators. The ability to export entire books including restricted sections undermines the business model of digital publishing platforms that rely on tiered access or per-chapter purchases for monetization. Attackers can systematically scrape large volumes of copyrighted material by iterating through available book identifiers, leading to substantial financial losses and potential legal liabilities related to copyright infringement. Furthermore, because the vulnerability requires only authenticated backend accounts, it may be exploited by malicious insiders who have been granted administrative credentials but lack legitimate business justification for accessing premium content. The ease of exploitation via simple HTTP requests with specific parameters makes this a high-risk issue that can be automated using standard web scraping tools or custom scripts, amplifying the scale and speed at which data can be stolen before detection occurs in typical monitoring environments.
In terms of industry classification standards, this vulnerability aligns closely with CWE-285 Improper Authorization, as it involves failing to enforce proper access controls for a specific action. It also relates to CWE-639 Injection of Critical Data into an External System if the downloaded content is subsequently used in downstream processes without validation, though the primary issue remains authorization failure. Within the MITRE ATT&CK framework, this behavior corresponds to T1078 Valid Accounts, where attackers leverage legitimate credentials to access resources they are not authorized for, and potentially T1530 Data from Information Repositories if large-scale scraping is conducted. The lack of consistent enforcement across different endpoints highlights a common architectural flaw in web applications where security logic is duplicated rather than centralized, leading to discrepancies that can be exploited by adversaries familiar with the application's structure.
To mitigate this vulnerability and prevent similar issues in future development cycles, it is essential to implement a unified authorization middleware or service layer that enforces consistent permission checks across all endpoints. Developers should refactor the BookController download logic to explicitly verify user subscription status, purchase history, or administrative privileges before generating any response containing book content. Additionally, implementing rate limiting and anomaly detection on this endpoint can help identify and block automated scraping attempts even if authorization is temporarily bypassed. Regular security audits focusing on API consistency are recommended to ensure that all data access points adhere to the same strict validation rules as those enforced in the primary admin interface. Finally, adopting a principle of least privilege for backend accounts ensures that administrative credentials do not inadvertently grant excessive rights over sensitive commercial content unless explicitly required for specific operational tasks.