# CVE-2026-123677: xxyopen novel authorization bypass in chapter read operations

Source: https://junglewise.ai/threats/cve-2026-123677-a-vulnerability-was-found-in-xxyopen-201206030-novel-up-to-3-5-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-06. Updated: 2026-11-06  
License: CC BY 4.0 with a link back

CVE-2026-123677 · Severity: medium · CVSS 4.3 · Published 2026-11-06

A novel publication platform allows any registered author to read other authors' unpublished drafts and paid content by manipulating chapter identifiers. This bypasses the paywall and exposes confidential work-in-progress material. An attacker with a basic author account can enumerate and retrieve another author's proprietary content without permission.

Technologies: [Xxyopen Novel](https://junglewise.ai/threats/technologies/novel). Vendors: [Xxyopen](https://junglewise.ai/threats/vendors/xxyopen).

## Quick answers

**Is CVE-2026-123677 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-123677 being exploited in the wild.

**How severe is CVE-2026-123677?** Medium severity, with a CVSS score of 4.3, published 6 November 2026.

**Which products and versions are affected?** Xxyopen Novel up to 3.5.0.

**Is there a fix for CVE-2026-123677?** Yes: fixed in commit b8134e774820e0971fa9d8074405b49a01c99bdc. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-123677 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-123677?** Check whether you run Xxyopen Novel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in commit b8134e774820e0971fa9d8074405b49a01c99bdc

## Technical details

The vulnerability is an authorization bypass in the getBookChapter() and listBookChapters() methods of BookServiceImpl.java. These read operations lack the authorship validation that was correctly implemented in the delete and update endpoints, allowing any authenticated author to specify arbitrary chapter or book IDs and retrieve content belonging to other authors. The fix adds an owner verification check before returning chapter data or chapter lists.

## Affected products

- xxyopen novel up to 3.5.0

## Timeline

- 2026-10-06: disclosed
- 2026-10-13: patched
- 2026-11-06: advisory

## References

- [https://github.com/201206030/novel/commit/b8134e774820e0971fa9d8074405b49a01c99bdc](https://github.com/201206030/novel/commit/b8134e774820e0971fa9d8074405b49a01c99bdc)
- [https://github.com/201206030/novel/pull/51](https://github.com/201206030/novel/pull/51)

## Related threats

- [Xxyopen novel weak password hashing vulnerability](https://junglewise.ai/threats/cve-2026-110104-xxyopen-novel-through-3-5-0-contains-a-weak-password-hashing)
- [DOM-based Cross-Site Scripting (XSS) vulnerability in 201206030 novel V3.5.0 allows remote attackers to execute…](https://junglewise.ai/threats/cve-2025-65442-dom-based-cross-site-scripting-xss-vulnerability-in-201206030)