CVE-2026-90940: novel-plus through 5.3.3 Default Cache Management Password in the Front Portal
novel-plus through 5.3.3 contains an insecure default cache-management password in the CacheController.refreshCache endpoint that allows anonymous attackers to invalidate portal caches by supplying the hardcoded default value in the URL path. Attackers can trigger unauthorized cache invalidation by accessing the cache/refresh endpoint with the known default password, forcing unnecessary database queries to repopulate the cache.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker who can reach the Front Portal cache refresh endpoint can trigger cache invalidation. No account, privileges, or user interaction are required.
What is the operational impact of exploitation?
An attacker can repeatedly invalidate portal caches, causing unnecessary database queries while the cache is repopulated. The provided impact information indicates availability impact only; no confidentiality or integrity impact is stated.
Are default deployments affected?
The issue is caused by a hardcoded default cache-management password in the CacheController.refreshCache endpoint. Deployments that retain that default value are affected.
How can I determine whether a deployment is affected?
Check whether the Front Portal uses a version through 5.3.3 and exposes the cache/refresh endpoint with the hardcoded default cache-management password. The vulnerable behavior is in CacheController.refreshCache and its related application configuration.