MEDIUM

CVE-2026-90940

2026-09-14 CVSS v3.1

CVSS

5.3

Description

novel-plus through 5.3.3 contains an insecure default cache-management password in the CacheController.refreshCache endpoint that allows anonymous attackers to invalidate portal caches by supplying the hardcoded default value in the URL path. Attackers can trigger unauthorized cache invalidation by accessing the cache/refresh endpoint with the known default password, forcing unnecessary database queries to repopulate the cache.

Weakness (CWE)

CWE-1392

EPSS Score

0.31%

Probability of exploitation in next 30 days

24.1th percentile

References

https://github.com/201206030/novel-plus https://github.com/201206030/novel-plus/blob/d63c3ee394657046ebd469e263532a350a60e930/novel-front/src/main/java/com/java2nb/novel/controller/CacheController.java https://github.com/201206030/novel-plus/blob/d63c3ee394657046ebd469e263532a350a60e930/novel-front/src/main/resources/application.yml https://github.com/201206030/novel-plus/releases/tag/v5.3.3 https://github.com/LinYuanyi1/cve-request-poc/blob/master/novel-plus/poc-07-front-cache-refresh-hardcoded-password.py https://www.vulncheck.com/advisories/novel-plus-through-5.3.3-default-cache-management-password-in-the-front-portal

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE