{"id":"CVE-2026-123677","kind":"vulnerability","aliases":["CVE-2026-123677"],"related":[],"title":"Novel reader app: chapter ID manipulation bypasses authorization checks","description":"A vulnerability was found in xxyopen/201206030 novel up to 3.5.0. Affected is the function getBookChapter of the file src/main/java/io/github/xxyopen/novel/service/impl/BookServiceImpl.java of the component Book Chapter Read Handler. Performing a manipulation of the argument chapterId results in authorization bypass. The attack may be initiated remotely. The exploit has been made public and could be used. The patch is named b8134e774820e0971fa9d8074405b49a01c99bdc. It is suggested to install a patch to address this issue.","summary":"The xxyopen novel web application up to version 3.5.0 has a flaw in its book chapter read handler where manipulating the chapterId argument bypasses authorization. An attacker can read chapter content they should not have access to, and a public exploit exists.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","novel-app","other","self-hosted"],"not_affected_if":["unknown"],"how_to_check":"- Look at the `getBookChapter` method in `src/main/java/io/github/xxyopen/novel/service/impl/BookServiceImpl.java` in your deployed copy\n- Check the deployed version against `3.5.0`; versions up to and including it are listed as affected","fix":"- Install the patch referenced as commit `b8134e774820e0971fa9d8074405b49a01c99bdc` in the project's repository\n- Fixed release version: unknown","status":"open","published_at":"2026-11-06T16:17:55+00:00","first_seen_at":"2026-11-06T16:42:41+00:00","triaged_at":"2026-11-06T16:44:50+00:00","updated_at":"2026-11-06T16:44:50+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-06T16:44:50Z","model":"claude-haiku-5-5","output":{"fix":"- Install the patch referenced as commit `b8134e774820e0971fa9d8074405b49a01c99bdc` in the project's repository\n- Fixed release version: unknown","reach":"internet","title":"Novel reader app: chapter ID manipulation bypasses authorization checks","impact":"low","summary":"The xxyopen novel web application up to version 3.5.0 has a flaw in its book chapter read handler where manipulating the chapterId argument bypasses authorization. An attacker can read chapter content they should not have access to, and a public exploit exists.","audience":"businesses","category":"other","nicknames":[],"who_cares":["java","novel-app","self-hosted"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker reads chapter content without authorization","analyst_note":"Confirm the fixed release version and whether the patch commit is in a tagged release; check the NVD page for the exploit reference.","how_to_check":"- Look at the `getBookChapter` method in `src/main/java/io/github/xxyopen/novel/service/impl/BookServiceImpl.java` in your deployed copy\n- Check the deployed version against `3.5.0`; versions up to and including it are listed as affected","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams running the xxyopen novel application at version 3.5.0 or earlier, where the chapter read endpoint is exposed to users. The flaw is in the chapter lookup path, so deployments that restrict access at a gateway in front of that endpoint may be less exposed, but the sources do not confirm this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000734,"input_tokens":4318,"output_tokens":605,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123677':12A,15A '-2026':11A,14A '3.5.0':32B,75C 'access':59B 'address':132C 'affect':76C 'app':3A,19B 'applic':28B 'argument':46B,97C 'attack':50B,104C 'author':8A,48B,101C 'b8134e774820e0971fa9d8074405b49a01c99bdc':123C 'book':38B,88C 'bypass':7A,47B,102C 'chapter':4A,39B,53B,89C 'chapterid':45B,98C 'check':9A 'compon':87C 'content':54B 'could':116C 'cve':10A,13A 'exist':65B 'exploit':64B,110C 'file':83C 'flaw':35B 'found':69C 'function':79C 'getbookchapt':80C 'handler':41B,91C 'host':23B 'id':5A 'initi':107C 'instal':128C 'issu':134C 'java':16B 'made':113C 'manipul':6A,43B,94C 'may':105C 'name':122C 'novel':1A,18B,26B,72C 'novel-app':17B 'patch':120C,130C 'perform':92C 'public':63B,114C 'read':40B,52B,90C 'reader':2A 'remot':108C 'result':99C 'self':22B 'self-host':21B 'src/main/java/io/github/xxyopen/novel/service/impl/bookserviceimpl.java':84C 'suggest':126C 'use':118C 'version':31B 'vulner':67C 'web':27B 'xxyopen':25B 'xxyopen/201206030':71C","nicknames":[],"mitigations":[],"who_affected":"Teams running the xxyopen novel application at version 3.5.0 or earlier, where the chapter read endpoint is exposed to users. The flaw is in the chapter lookup path, so deployments that restrict access at a gateway in front of that endpoint may be less exposed, but the sources do not confirm this.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["java","medium","novelapp","other","selfhosted"],"campaign_type":null,"search_a":"'-123677':12A,15A '-2026':11A,14A 'app':3A 'author':8A 'bypass':7A 'chapter':4A 'check':9A 'cve':10A,13A 'id':5A 'manipul':6A 'novel':1A 'reader':2A","search_b":"'3.5.0':32B 'access':59B 'app':19B 'applic':28B 'argument':46B 'attack':50B 'author':48B 'book':38B 'bypass':47B 'chapter':39B,53B 'chapterid':45B 'content':54B 'exist':65B 'exploit':64B 'flaw':35B 'handler':41B 'host':23B 'java':16B 'manipul':43B 'novel':18B,26B 'novel-app':17B 'public':63B 'read':40B,52B 'self':22B 'self-host':21B 'version':31B 'web':27B 'xxyopen':25B","search_c":"'3.5.0':75C 'address':132C 'affect':76C 'argument':97C 'attack':104C 'author':101C 'b8134e774820e0971fa9d8074405b49a01c99bdc':123C 'book':88C 'bypass':102C 'chapter':89C 'chapterid':98C 'compon':87C 'could':116C 'exploit':110C 'file':83C 'found':69C 'function':79C 'getbookchapt':80C 'handler':91C 'initi':107C 'instal':128C 'issu':134C 'made':113C 'manipul':94C 'may':105C 'name':122C 'novel':72C 'patch':120C,130C 'perform':92C 'public':114C 'read':90C 'remot':108C 'result':99C 'src/main/java/io/github/xxyopen/novel/service/impl/bookserviceimpl.java':84C 'suggest':126C 'use':118C 'vulner':67C 'xxyopen/201206030':71C","first_public_at":"2026-11-06T16:17:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123677","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123677","severity":null,"published_at":"2026-11-06T16:17:55+00:00","modified_at":"2026-11-06T16:17:55+00:00","first_seen_at":"2026-11-06T16:42:41+00:00","fetched_at":"2026-11-06T16:42:41+00:00","note":null}],"documents":[{"id":87936,"url":"https://github.com/201206030/novel/commit/b8134e774820e0971fa9d8074405b49a01c99bdc","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}