Description

novel-plus through 5.3.3 contains an information disclosure vulnerability in the /sys/user/list endpoint that lacks proper permission annotations. Authenticated attackers can retrieve password hashes and personal data including email addresses and phone numbers for users within their data scope, enabling offline hash cracking and account takeover.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-14T14:17:20.240Z",
  "pubdate": "2026-09-14T14:17:20.240Z",
  "executiveSummary": "An information disclosure vulnerability exists in novel-plus versions up to 5.3.3 within the /sys/user/list endpoint. The flaw stems from a failure to implement mandatory permission annotations, allowing authenticated users to access sensitive account data that should be restricted based on their security clearance.\nThe impact of this vulnerability is severe, as it enables the unauthorized retrieval of user password hashes, email addresses, and phone numbers. An attacker possessing valid user credentials can leverage this information to perform offline password cracking, potentially leading to full account takeover and unauthorized escalation of privileges within the system.\nThe vulnerability is accessible to any authenticated attacker, regardless of their original role, provided they fall within the target's data scope. Because the endpoint does not properly validate authorization requirements, the system fails to maintain the confidentiality of sensitive user information. This represents a significant risk to the integrity and privacy of the application's user base, necessitating immediate attention to access control enforcement.",
  "technicalDetails": "The root cause of this vulnerability is an insecure implementation of access control on the /sys/user/list endpoint in novel-plus versions through 5.3.3. Specifically, the backend controller responsible for this API endpoint lacks proper annotation-based permission checks, such as those provided by Shiro or Spring Security, which are intended to restrict data access to authorized administrative roles.\nThe exploitation process is straightforward for an authenticated user. Once the attacker establishes a valid session within the application, they can manually craft a request to the /sys/user/list endpoint. Because the application fails to verify if the requester has the requisite privileges to view user directory information, the backend service processes the query and returns a JSON-formatted response containing sensitive fields.\nThe retrieved dataset includes, but is not limited to, salted password hashes and PII (Personally Identifiable Information) such as email addresses and phone numbers of other users within the data scope. The attack flow is as follows: 1) The attacker authenticates to the application; 2) The attacker sends an HTTP GET or POST request to the /sys/user/list endpoint; 3) The server-side component fails to invoke an authorization interceptor or permission check due to missing method-level annotations; 4) The server executes the database query and serializes the full user record objects; 5) The sensitive data is transmitted to the attacker in the HTTP response body.\nPost-exploitation, the attacker can aggregate the password hashes and employ offline brute-force or dictionary-based cracking techniques to recover plaintext credentials. Access to email addresses and phone numbers further facilitates secondary attacks, such as social engineering or account hijacking via reset-password functionalities. Since this occurs at the application layer, the vulnerability is exposed to any user with a valid account, making the network exposure level equal to the reachability of the web application. The absence of robust perimeter-based access control or endpoint-level validation ensures that the information is exposed regardless of the specific business logic intended for the /sys/user/list interface."
}