Quick answers
- Is CVE-2026-90940 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-90940 being exploited in the wild.
- How severe is CVE-2026-90940?
- Medium severity, with a CVSS score of 5.3, published 14 September 2026.
- Which products and versions are affected?
- 201206030 Novel-Plus through 5.3.3.
- Is there a fix for CVE-2026-90940?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-90940 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-90940?
- Check whether you run 201206030 Novel-Plus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The CacheController.refreshCache endpoint accepts a password parameter in the URL path and compares it against a configurable cache manager password. However, the default configuration contains a hardcoded weak password value that is widely known or easily guessable. An unauthenticated attacker can supply this default password in the endpoint URL (cache/refresh/{password}/{type}) to trigger cache invalidation for homepage recommendations, news, or friend links. This forces the application to repopulate caches from the database on subsequent requests, increasing database load and potentially causing service degradation. There is no authentication or rate limiting protecting this endpoint.
Affected products
- 201206030 novel-plus through 5.3.3
Timeline
- 2026-09-14: disclosed