CVE-2026-90940

Name of the Vulnerable Software and Affected Versions novel-plus versions prior to 5.3.4

Description An insecure default cache-management password exists in the 'CacheController.refreshCache' endpoint. Anonymous attackers can invalidate portal caches by providing the hardcoded default value in the URL path of the 'cache/refresh' endpoint. This action forces the system to perform unnecessary database queries to repopulate the cache.

Recommendations Update novel-plus to version 5.3.4 or later. Restrict access to the 'cache/refresh' endpoint to prevent unauthorized cache invalidation.