# CVE-2026-123676: xxyopen/201206030 novel authorization bypass in Book Content Service

Source: https://junglewise.ai/threats/cve-2026-123676-a-vulnerability-has-been-found-in-xxyopen-201206030-novel-up-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-06. Updated: 2026-11-06  
License: CC BY 4.0 with a link back

CVE-2026-123676 · Severity: medium · CVSS 5.3 · Published 2026-11-06

A novel publishing platform contains a critical flaw that allows anyone, including anonymous users, to read paid chapters without authentication or purchase. The platform is supposed to charge users for premium (VIP) content, but the authorization check is missing from the content-serving endpoint, making the payment system completely ineffective and enabling revenue loss.

Vendors: [Xxyopen](https://junglewise.ai/threats/vendors/xxyopen).

## Quick answers

**Is CVE-2026-123676 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-123676 being exploited in the wild.

**How severe is CVE-2026-123676?** Medium severity, with a CVSS score of 5.3, published 6 November 2026.

**Which products and versions are affected?** Xxyopen 201206030 Novel up to 3.5.0.

**Is there a fix for CVE-2026-123676?** Yes: fixed in Fixed by commit 966c4bdde3521dc0a165d15a2acff66ee33eaaa7. Until then: Restrict access to the GET /api/front/book/content/{chapterId} endpoint by requiring authentication and implementing server-side authorization checks against the user_consume_log table before returning content for chapters marked as VIP (isVip=1). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-123676 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-123676?** Check whether you run Xxyopen 201206030 Novel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Fixed by commit 966c4bdde3521dc0a165d15a2acff66ee33eaaa7

Restrict access to the GET /api/front/book/content/{chapterId} endpoint by requiring authentication and implementing server-side authorization checks against the user_consume_log table before returning content for chapters marked as VIP (isVip=1).

## Technical details

The BookServiceImpl.getBookContentAbout() method, exposed via the public GET /api/front/book/content/{chapterId} endpoint, returns VIP chapter content unconditionally without checking the isVip flag or verifying purchase entitlement via the user_consume_log table. Authentication is optional on this endpoint (TokenParseInterceptor only parses JWT if present), so anonymous requests succeed. The fix adds authentication and entitlement checks before returning VIP content, requiring a matching purchase record in user_consume_log.

## Affected products

- xxyopen 201206030 novel up to 3.5.0

## Timeline

- 2026-10-07: disclosed: Vulnerability details published in GitHub PR #52
- 2026-10-13: patched: Fix merged via commit 966c4bd
- 2026-11-06: advisory

## References

- [https://github.com/201206030/novel/commit/966c4bdde3521dc0a165d15a2acff66ee33eaaa7](https://github.com/201206030/novel/commit/966c4bdde3521dc0a165d15a2acff66ee33eaaa7)
- [https://github.com/201206030/novel/pull/52](https://github.com/201206030/novel/pull/52)