CVE-2026-90939

novel-plus through version 5.3.3 contains a missing-authorization flaw (CWE-862): the /sys/user/list endpoint lacks proper permission annotations. Any authenticated user, even one with minimal privileges, can call the endpoint and retrieve account records for users within their data scope, including password hashes, email addresses, and phone numbers. The exposed password hashes can be cracked offline to enable account takeover, and the personal contact data supports follow-on phishing and targeting. All self-hosted deployments of novel-plus at or below 5.3.3 are affected. No public proof-of-concept exists, the flaw is not in CISA's KEV catalog, and no exploitation in the wild has been reported.

What to do: Upgrade to the latest novel-plus release and verify that /sys/user/list now enforces administrator-level permission annotations; if upgrading is delayed, restrict the endpoint to admin roles at the reverse proxy or application security layer. Review access logs for non-admin requests to /sys/user/list and force password resets for any users whose hashes may have been retrieved, since the hashes can be cracked offline.