Description

A vulnerability was found in xxyopen/201206030 novel up to 3.5.0. Affected is the function getBookChapter of the file src/main/java/io/github/xxyopen/novel/service/impl/BookServiceImpl.java of the component Book Chapter Read Handler. Performing a manipulation of the argument chapterId results in authorization bypass. The attack may be initiated remotely. The exploit has been made public and could be used. The patch is named b8134e774820e0971fa9d8074405b49a01c99bdc. It is suggested to install a patch to address this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-11-06T16:17:55.247Z",
  "pubdate": "2026-11-06T16:17:55.247Z",
  "executiveSummary": "A critical authorization bypass vulnerability exists in the xxyopen/201206030 novel application, specifically within versions up to 3.5.0.\nThe vulnerability resides in the getBookChapter function located in src/main/java/io/github/xxyopen/novel/service/impl/BookServiceImpl.java.\nAn unauthenticated or authenticated remote attacker can exploit this flaw by manipulating the chapterId parameter during a request to the Book Chapter Read Handler.\nSuccessful exploitation allows unauthorized access to book chapters, potentially bypassing access control lists or subscription requirements intended to protect restricted content.\nThis vulnerability poses a significant risk to data confidentiality, as it permits unauthorized retrieval of sensitive application content.\nGiven that the exploit is public, the risk level is elevated, necessitating immediate remediation through the application of the provided patch.",
  "technicalDetails": "The vulnerability is an Improper Authorization flaw identified within the Book Chapter Read Handler component of the xxyopen/201206030 novel application.\nThe root cause of this issue is insufficient server-side validation of the chapterId parameter within the getBookChapter method in src/main/java/io/github/xxyopen/novel/service/impl/BookServiceImpl.java. The application fails to properly verify if the requester possesses the necessary permissions to access the chapter corresponding to the provided ID.\nThe attack flow initiates with a remote attacker interacting with the web application’s chapter retrieval endpoint. By supplying a crafted or manipulated chapterId, the attacker triggers the flawed logic within the getBookChapter service. Because the backend code neglects to validate the user's session or authorization status against the requested resource, the application logic proceeds to retrieve and display the chapter content.\nThe exploitation process does not require elevated privileges, as the flaw resides in the lack of an authorization check at the service layer. When the request is processed, the application retrieves the data from the underlying repository based solely on the user-supplied chapterId without cross-referencing this against the user's entitlements or subscription state.\nBecause the exploit is public, threat actors can automate the harvesting of restricted or premium content by iterating through valid or predictable chapterId values. This type of Insecure Direct Object Reference (IDOR) behavior results in a complete bypass of the intended business logic constraints.\nThe impact is a loss of confidentiality regarding the content protected by the authorization mechanism. Unauthorized parties can access restricted book data, which may violate content licensing agreements or business model requirements.\nThe affected versions include all releases of xxyopen/201206030 novel up to and including 3.5.0. Remediation requires the implementation of the security patch b8134e774820e0971fa9d8074405b49a01c99bdc, which rectifies the missing authorization logic within the BookServiceImpl component."
}