CVE-2026-123676 Details
Description
A vulnerability has been found in xxyopen/201206030 novel up to 3.5.0. This impacts the function BookServiceImpl.getBookContentAbout of the file src/main/java/io/github/xxyopen/novel/service/impl/BookServiceImpl.java of the component Book Content Service. Such manipulation of the argument chapterId leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 966c4bdde3521dc0a165d15a2acff66ee33eaaa7. Applying a patch is advised to resolve this issue.
An improper authorization vulnerability has been identified in the xxyopen/201206030 novel application, affecting versions up to 3.5.0. The issue arises in the BookServiceImpl.getBookContentAbout function, located in the BookServiceImpl.java file. The vulnerability allows remote attackers to manipulate the chapterId argument, leading to unauthorized access to chapter content. This vulnerability has been publicly disclosed and exploited.
Users are advised to update to the latest version of the xxyopen/201206030 novel application, where this vulnerability has been patched. The patch can be found in the application's GitHub repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/201206030/novel/commit/966c4bdde3521dc0a165d15a2acff66ee33eaaa7 | [email protected] | Source CodeVendor |
| https://github.com/201206030/novel/pull/52 | [email protected] | Issue TrackingVendor |
| https://vuldb.com/cve/CVE-2026-123676 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1033603 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/431793 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/431793/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-266 | Incorrect Privilege Assignment | [email protected] |
| CWE-285 | Improper Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| xxyopen/201206030 novel | <= 3.5.0 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | New CVE Received | [email protected] |