CVE-2026-123676
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A vulnerability has been found in xxyopen/201206030 novel up to version 3.5.0 in the BookServiceImpl.getBookContentAbout function of BookServiceImpl.java, which handles book content. Manipulating the chapterId argument leads to improper authorization, and the attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Risk Assessment
A remote attacker could access book content without the required permissions, potentially leading to data exposure. The publicly known exploit increases the risk of exploitation.
Recommendation
Apply patch 966c4bdde3521dc0a165d15a2acff66ee33eaaa7 or upgrade to a version containing the fix without delay.
Other vulnerabilities in novel
See all- CVE-2026-123677Medium
A vulnerability was found in xxyopen/201206030 novel up to version 3.5.0 in the getBookChapter function of BookServiceImpl.java, which handles book chapter reading. Manipulating the chapterId argument results in an authorization bypass, and the attack can be launched remotely. The exploit has been publicly disclosed and may be used.
- CVE-2025-65442Medium
A DOM-based Cross-Site Scripting (XSS) vulnerability in novel V3.5.0 (201206030) allows remote attackers to execute arbitrary JavaScript code or disclose sensitive information (e.g., user session cookies) via a crafted "wvstest" parameter in the URL or malicious script injection into window.localStorage. The issue arises from insufficient validation and encoding of user-controllable data in the book comment module: unfiltered user input is stored in the backend database (book_comment table, commentContent field) and returned via API, then rendered directly into the page DOM via Vue 3's v-html directive without sanitization.
Original NVD description (English source)
A vulnerability has been found in xxyopen/201206030 novel up to 3.5.0. This impacts the function BookServiceImpl.getBookContentAbout of the file src/main/java/io/github/xxyopen/novel/service/impl/BookServiceImpl.java of the component Book Content Service. Such manipulation of the argument chapterId leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 966c4bdde3521dc0a165d15a2acff66ee33eaaa7. Applying a patch is advised to resolve this issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS