THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-90940 (MEDIUM 5.3) — novel-plus through 5.3.3 contains an insecure default cache-management password in the CacheController.refreshCache endpoint that allows anonymous attackers to invalidate portal caches by supplying the hardcoded default value in the URL path. Attackers can trigger unauthorized ca

[NVD] CVE-2026-90940 (MEDIUM 5.3) — novel-plus through 5.3.3 contains an insecure default cache-management password in the CacheController.refreshCache endpoint that allows anonymous attackers to invalidate portal caches by supplying the hardcoded default value in the URL path. Attackers can trigger unauthorized ca

mednvdPublished 2026-09-14

CVE-2026-90940 CVSS: 5.3 MEDIUM Published: 2026-09-14T14:17:20.400

novel-plus through 5.3.3 contains an insecure default cache-management password in the CacheController.refreshCache endpoint that allows anonymous attackers to invalidate portal caches by supplying the hardcoded default value in the URL path. Attackers can trigger unauthorized cache invalidation by accessing the cache/refresh endp

Indicators of compromise

CVE-2026-90940cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-90940