CVE-2026-123676 A vulnerability has been found in xxyopen/201206030 novel up to 3.5.0.
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-123676?
CVE-2026-123676 is a medium-severity vulnerability in 201206030 novel, published on 6 Nov 2026.
Official description
A vulnerability has been found in xxyopen/201206030 novel up to 3.5.0. This impacts the function BookServiceImpl.getBookContentAbout of the file src/main/java/io/github/xxyopen/novel/service/impl/BookServiceImpl.java of the component Book Content Service. Such manipulation of the argument chapterId leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 966c4bdde3521dc0a165d15a2acff66ee33eaaa7. Applying a patch is advised to resolve this issue.
Which versions are affected by CVE-2026-123676?
How do I fix CVE-2026-123676?
No fix has been published for CVE-2026-123676 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-123676 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-123676 exists.
Sources
Also known as GHSA-cfhj-grhg-7vf3.