CVE-2026-90940 novel-plus through 5.3.3 Default Cache Management Password in the Front Portal
Attackers can use a hardcoded default password to trigger unauthorized cache invalidation, causing denial of service via excessive database queries.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-90940?
CVE-2026-90940 is a medium-severity vulnerability in 201206030 novel-plus, published on 14 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
novel-plus through 5.3.3 contains an insecure default cache-management password in the CacheController.refreshCache endpoint that allows anonymous attackers to invalidate portal caches by supplying the hardcoded default value in the URL path. Attackers can trigger unauthorized cache invalidation by accessing the cache/refresh endpoint with the known default password, forcing unnecessary database queries to repopulate the cache.
Weakness: CWE-1392
Which versions are affected by CVE-2026-90940?
How do I fix CVE-2026-90940?
No fix has been published for CVE-2026-90940 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-90940 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-90940 exists.
Sources
Also known as GHSA-hqxh-9xh6-r77j.