---
id: CVE-2026-90940
title: >-
  novel-plus through 5.3.3 contains an insecure default cache-management
  password in the CacheController.refreshCache endpoint that allows anonymous
  attackers to invalidate portal caches by supplying the hardcoded default value
  in the URL …
summary: >-
  novel-plus through 5.3.3 contains an insecure default cache-management
  password in the CacheController.refreshCache endpoint that allows anonymous
  attackers to invalidate portal caches by supplying the hardcoded default value
  in the URL …
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-1392
vendor: '201206030'
product: novel-plus
affected:
  - novel-plus <= 5.3.3
published: '2026-09-14'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T17:17:44.587'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90940'
references:
  - url: 'https://github.com/201206030/novel-plus'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/201206030/novel-plus/blob/d63c3ee394657046ebd469e263532a350a60e930/novel-front/src/main/java/com/java2nb/novel/controller/CacheController.java
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/201206030/novel-plus/blob/d63c3ee394657046ebd469e263532a350a60e930/novel-front/src/main/resources/application.yml
    label: disclosure@vulncheck.com
  - url: 'https://github.com/201206030/novel-plus/releases/tag/v5.3.3'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/LinYuanyi1/cve-request-poc/blob/master/novel-plus/poc-07-front-cache-refresh-hardcoded-password.py
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/novel-plus-through-5.3.3-default-cache-management-password-in-the-front-portal
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00546
epssPercentile: 0.43424
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-20T00:13:27.331352Z'
ingestedAt: '2026-09-14T15:23:07.422Z'
---

## Overview

novel-plus through 5.3.3 contains an insecure default cache-management password in the CacheController.refreshCache endpoint that allows anonymous attackers to invalidate portal caches by supplying the hardcoded default value in the URL path. Attackers can trigger unauthorized cache invalidation by accessing the cache/refresh endpoint with the known default password, forcing unnecessary database queries to repopulate the cache.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.