Is CVE-2026-90941 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-90941 being exploited in the wild.

How severe is CVE-2026-90941?

Medium severity, with a CVSS score of 4.3, published 14 September 2026.

Which products and versions are affected?

novel-plus novel-plus through 5.3.3.

Is there a fix for CVE-2026-90941?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-90941 attacked?

It is attacked over the network.

Am I affected by CVE-2026-90941?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-90941: novel-plus authorization bypass in BookController download endpoint

CVE-2026-90941 · Severity: medium · CVSS 4.3 · Published 2026-09-14

novel-plus is an open-source novel reading CMS system with subscription and VIP features. An authenticated attacker with backend admin access can bypass permission checks in the book download endpoint to export complete books including paid chapters without triggering VIP or purchase verification, undermining the subscription revenue model and exposing paid content.

Quick answers

Is CVE-2026-90941 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-90941 being exploited in the wild.
How severe is CVE-2026-90941?: Medium severity, with a CVSS score of 4.3, published 14 September 2026.
Which products and versions are affected?: novel-plus novel-plus through 5.3.3.
Is there a fix for CVE-2026-90941?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-90941 attacked?: It is attacked over the network.
Am I affected by CVE-2026-90941?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The BookController download endpoint in novel-plus through version 5.3.3 fails to enforce proper authorization checks on book content retrieval. An authenticated backend admin can supply a bookId and bookName parameter to retrieve all chapter content, including premium/paid chapters, bypassing the VIP status verification and purchase authorization checks that are enforced elsewhere in the application. The vulnerability requires valid backend authentication and allows complete book text export. A patch or update beyond version 5.3.3 is needed to add proper permission validation in the download endpoint.

Affected products

novel-plus novel-plus through 5.3.3

Timeline

2026-09-14: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.