---
id: "CVE-2026-123677"
page: "https://infrastack.ai/live/CVE-2026-123677"
kind: "vulnerability"
aliases: ["CVE-2026-123677"]
title: "Novel reader app: chapter ID manipulation bypasses authorization checks"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["java", "novel-app", "other", "self-hosted"]
not_affected_if: ["unknown"]
published_at: "2026-11-06T16:17:55+00:00"
first_seen_at: "2026-11-06T16:42:41+00:00"
updated_at: "2026-11-06T16:44:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123677", "first_seen_at": "2026-11-06T16:42:41+00:00"}]
exploit_sources: []
---

# Novel reader app: chapter ID manipulation bypasses authorization checks

Link for people: https://infrastack.ai/live/CVE-2026-123677 (this .md is for agents)

The xxyopen novel web application up to version 3.5.0 has a flaw in its book chapter read handler where manipulating the chapterId argument bypasses authorization. An attacker can read chapter content they should not have access to, and a public exploit exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look at the `getBookChapter` method in `src/main/java/io/github/xxyopen/novel/service/impl/BookServiceImpl.java` in your deployed copy
- Check the deployed version against `3.5.0`; versions up to and including it are listed as affected

## Fix

- Install the patch referenced as commit `b8134e774820e0971fa9d8074405b49a01c99bdc` in the project's repository
- Fixed release version: unknown

## Timeline

- 2026-11-06T16:42:41+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123677

## Documents

- [fix] Patch: github.com https://github.com/201206030/novel/commit/b8134e774820e0971fa9d8074405b49a01c99bdc

## From the sources

A vulnerability was found in xxyopen/201206030 novel up to 3.5.0. Affected is the function getBookChapter of the file src/main/java/io/github/xxyopen/novel/service/impl/BookServiceImpl.java of the component Book Chapter Read Handler. Performing a manipulation of the argument chapterId results in authorization bypass. The attack may be initiated remotely. The exploit has been made public and could be used. The patch is named b8134e774820e0971fa9d8074405b49a01c99bdc. It is suggested to install a patch to address this issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_