CVE-2026-90941: novel-plus through 5.3.3 Missing Authorization on the Admin Book Download Endpoint
novel-plus through 5.3.3 contains an authorization bypass vulnerability in the BookController download endpoint that allows authenticated backend accounts to export complete book text including paid chapters. Attackers can supply a bookId and bookName to retrieve all chapter content without VIP or purchase verification, bypassing the permission checks and data-scope limits enforced elsewhere in the admin interface.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated backend account. The issue affects backend users who can reach the admin BookController download endpoint; no VIP status or purchase is required to export protected chapter content.
What information does an attacker need to retrieve a book?
The attacker can supply a bookId and bookName to the download endpoint. These inputs can be used to retrieve complete chapter text, including paid chapters.
Are data-scope restrictions sufficient to prevent exploitation?
No. The vulnerable endpoint bypasses the permission checks and data-scope limits that are enforced elsewhere in the admin interface.