CVE-2026-90940

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-90940
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90940.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-90940
Published
2026-09-14T13:58:43Z
Modified
2026-09-16T03:48:26Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
novel-plus through 5.3.3 Default Cache Management Password in the Front Portal
Details

novel-plus through 5.3.3 contains an insecure default cache-management password in the CacheController.refreshCache endpoint that allows anonymous attackers to invalidate portal caches by supplying the hardcoded default value in the URL path. Attackers can trigger unauthorized cache invalidation by accessing the cache/refresh endpoint with the known default password, forcing unnecessary database queries to repopulate the cache.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-1392"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90940.json"
}
References

Affected packages

Git / github.com/201206030/novel-plus

Affected ranges

Type
GIT
Repo
https://github.com/201206030/novel-plus
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
d63c3ee394657046ebd469e263532a350a60e930
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "5.3.3"
        },
        {
            "fixed": "5.3.3"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

4.*
4.1.0
4.2.0
v1.*
v1.0.0
v1.1.0
v1.1.1
v2.*
v2.0.0
v2.0.2
v2.1.2
v2.5.0
v2.6.0
v2.8.0
v3.*
v3.0.2
v3.1.0
v3.3.0
v3.5.0
v3.5.1
v3.5.3
v3.5.4
v3.6.0
v3.6.1
v3.6.2
v4.*
v4.0.0
v4.3.0-RC1
v4.4.0
v5.*
v5.0.0
v5.1.0
v5.1.1
v5.1.2
v5.1.3
v5.1.5
v5.2.0
v5.2.1
v5.2.2
v5.2.3
v5.2.4
v5.2.5
v5.2.6
v5.3.0
v5.3.1
v5.3.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90940.json"