Read the docs
TI-2026-85978 Aliases CVE-2026-123676GHSA-cfhj-grhg-7vf3

Improper authorization in xxyopen novel book content service

Priority LOW 30CWE-266Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Privilege escalation, Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-266 and CWE-285.

Summary

The xxyopen novel project, also listed as 201206030 novel, is affected up to version 3.5.0. The getBookContentAbout function in BookServiceImpl does not check authorization properly for the chapterId argument (CWE-285). A remote attacker without privileges or user interaction can access data without authorization, with low confidentiality impact. A public exploit has been disclosed and may be used.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

A vulnerability has been found in xxyopen/201206030 novel up to 3.5.0. This impacts the function BookServiceImpl.getBookContentAbout of the file src/main/java/io/github/xxyopen/novel/service/impl/BookServiceImpl.java of the component Book Content Service. Such manipulation of the argument chapterId leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 966c4bdde3521dc0a165d15a2acff66ee33eaaa7. Applying a patch is advised to resolve this issue.

Why it matters now

EPSS 0.00311 24th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
201206030novel3.0; 3.1; 3.2; 3.3; 3.4; 3.5.0—No fix listedCNA
201206030novel3.0; 3.1; 3.2; 3.3; 3.4; 3.5.0—No fix listedCNA
  • novel Vendor201206030 Affected 3.0; 3.1; 3.2; 3.3; 3.4; 3.5.0 Fixed in — No fix listed CNA
  • novel Vendor201206030 Affected 3.0; 3.1; 3.2; 3.3; 3.4; 3.5.0 Fixed in — No fix listed CNA

CPE names CNA · 2

CPEVersionsRoleVendor
cpe:2.3:a:xxyopen:novel:*:*:*:*:*:*:*:*——201206030
cpe:2.3:a:201206030:novel:*:*:*:*:*:*:*:*———
  • cpe:2.3:a:xxyopen:novel:*:*:*:*:*:*:*:* Versions — — ·201206030
  • cpe:2.3:a:201206030:novel:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

The sources list no fixed version for novel. The patch is named 966c4bd, and applying it is advised.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-123676
  2. 2026-11-06 Alias added: GHSA-cfhj-grhg-7vf3
  3. 2026-11-08 Priority changed: MEDIUM → LOW

References

Exploit 1

Patch 1

  • TI-2025-28892 Directory Traversal vulnerability in novel plus before v.5.1.0 allows a remote attacker… CVSS 3.1CRITICAL 9.8
  • TI-2023-25366 SQL injection vulnerability in Novel-Plus v.4.2.0 allows a remote attacker to execute… CVSS 3.1CRITICAL 9.8
  • TI-2023-14116 novel-plus 3.6.2 is vulnerable to SQL Injection. CVSS 3.1CRITICAL 9.8
  • TI-2024-00867 Novel-Plus list sql injection CVSS 3.1CRITICAL 9.8
  • TI-2024-00605 Novel-Plus list sql injection CVSS 3.1CRITICAL 9.8
  • TI-2024-22039 Arbitrary File Read vulnerability in novel-plus 4.3.0 and before allows a remote attacker… CVSS 3.1HIGH 7.5
See all 59 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences