What is CVE-2026-90940?

CVE-2026-90940 is a medium-severity vulnerability in 201206030 Novel-Plus, classified under CWE-1392. CVSS score: 5.3/10. Published 2026-09-14.

How severe is CVE-2026-90940?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Vulnerability in 201206030 Novel-Plus

CVE-2026-90940

novel-plus through 5.3.3 contains an insecure default cache-management password in the CacheController.refreshCache endpoint that allows anonymous attackers to invalidate portal caches by supplying the hardcoded default value in the URL path. Attackers can trigger unauthorized cache invalidation by accessing the cache/refresh endpoint with the known default password, forcing unnecessary database queries to repopulate the cache.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.

Affected products

201206030 Novel-plus

Weakness classification (CWE)

CWE-1392

References

disclosure@vulncheck.com (product)
disclosure@vulncheck.com (technical-description)
disclosure@vulncheck.com (technical-description)
disclosure@vulncheck.com (release-notes)
disclosure@vulncheck.com (exploit)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-90940?: CVE-2026-90940 is a medium-severity vulnerability in 201206030 Novel-Plus, classified under CWE-1392. CVSS score: 5.3/10. Published 2026-09-14.
How severe is CVE-2026-90940?: Medium severity. CVSS v3 base score is 5.3 out of 10.