CVE-2026-123677 · Other
NO FIX YET · SEE WHAT TO DO
The xxyopen novel web application up to version 3.5.0 has a flaw in its book chapter read handler where manipulating the chapterId argument bypasses authorization. An attacker can read chapter content they should not have access to, and a public exploit exists.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running the xxyopen novel application at version 3.5.0 or earlier, where the chapter read endpoint is exposed to users. The flaw is in the chapter lookup path, so deployments that restrict access at a gateway in front of that endpoint may be less exposed, but the sources do not confirm this.
Not affected if unknown
Who cares java, novel-app, self-hosted
getBookChapter method in src/main/java/io/github/xxyopen/novel/service/impl/BookServiceImpl.java in your deployed copy3.5.0; versions up to and including it are listed as affectedb8134e774820e0971fa9d8074405b49a01c99bdc in the project's repositoryA vulnerability was found in xxyopen/201206030 novel up to 3.5.0. Affected is the function getBookChapter of the file src/main/java/io/github/xxyopen/novel/service/impl/BookServiceImpl.java of the component Book Chapter Read Handler. Performing a manipulation of the argument chapterId results in authorization bypass. The attack may be initiated remotely. The exploit has been made public and could be used. The patch is named b8134e774820e0971fa9d8074405b49a01c99bdc. It is suggested to install a patch to address this issue.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.