---
id: CVE-2026-123676
title: >-
  xxyopen/201206030 novel Book Content Service BookServiceImpl.java
  BookServiceImpl.getBookContentAbout improper authorization
summary: >-
  A vulnerability has been found in xxyopen/201206030 novel up to 3.5.0. This
  impacts the function BookServiceImpl.getBookContentAbout of the file
  src/main/java/io/github/xxyopen/novel/service/impl/BookServiceImpl.java of the
  component Boo…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C'
cvssSource: cna
cwe:
  - CWE-285
  - CWE-266
vendor: xxyopen
product: novel
affected:
  - novel 3.0
  - novel 3.1
  - novel 3.2
  - novel 3.3
  - novel 3.4
  - novel 3.5.0
  - novel 3.0
  - novel 3.1
  - novel 3.2
  - novel 3.3
  - novel 3.4
  - novel 3.5.0
published: '2026-11-06'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T15:30:23.322Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-123676'
references:
  - url: 'https://vuldb.com/vuln/431793'
    label: >-
      VDB-431793 | xxyopen/201206030 novel Book Content Service
      BookServiceImpl.java BookServiceImpl.getBookContentAbout improper
      authorization
  - url: 'https://vuldb.com/vuln/431793/cti'
    label: 'VDB-431793 | CTI Indicators (IOB, IOC, TTP, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-123676'
    label: CVE-2026-123676 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1033603'
    label: >-
      Submit #1033603 | https://github.com/201206030/ novel 3.5.0 Missing
      Authorization
  - url: 'https://github.com/201206030/novel/pull/52'
  - url: >-
      https://github.com/201206030/novel/commit/966c4bdde3521dc0a165d15a2acff66ee33eaaa7
tags:
  - cve.org
ingestedAt: '2026-11-06T15:54:04.059Z'
epss: 0.00311
epssPercentile: 0.24163
---

## Overview

A vulnerability has been found in xxyopen/201206030 novel up to 3.5.0. This impacts the function BookServiceImpl.getBookContentAbout of the file src/main/java/io/github/xxyopen/novel/service/impl/BookServiceImpl.java of the component Book Content Service. Such manipulation of the argument chapterId leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 966c4bdde3521dc0a165d15a2acff66ee33eaaa7. Applying a patch is advised to resolve this issue.

## Affected

- `novel 3.0`
- `novel 3.1`
- `novel 3.2`
- `novel 3.3`
- `novel 3.4`
- `novel 3.5.0`
- `novel 3.0`
- `novel 3.1`
- `novel 3.2`
- `novel 3.3`
- `novel 3.4`
- `novel 3.5.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.