The vulnerability CVE-2026-90939 affects novel-plus versions up to 5.3.3. It involves missing authorization controls on the /sys/user/list API endpoint, allowing authenticated users to retrieve sensitive information including password hashes and personal data of other users within their accessible scope. This flaw can lead to offline password cracking and unauthorized account access. The CVSS 3.1 base score is 6.5, indicating a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction. The vulnerability does not impact integrity or availability, only confidentiality.

An attacker with valid authentication can obtain password hashes and personal information (email addresses, phone numbers) of users within their data scope. This can facilitate offline password cracking and subsequent account takeover, compromising user confidentiality and potentially leading to unauthorized access to user accounts.

No vendor advisory or patch information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the /sys/user/list endpoint to trusted users only and monitor for suspicious activity involving this endpoint.