CVE-2026-5414
Improper Resource Identifier Control in Newgen OmniDocs WebAPI
Publication date: 2026-04-02
Last updated on: 2026-04-02
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| newgen | omnidocs | to 12.0.00 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-99 | The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Newgen OmniDocs up to version 12.0.00, specifically in an unknown functionality related to the file /omnidocs/WebApiRequestRedirection. It involves manipulation of the argument DocumentId, which leads to improper control of resource identifiers. The flaw can be exploited remotely, and the exploit has been publicly released.
How can this vulnerability impact me? :
The vulnerability allows an attacker to manipulate resource identifiers remotely by exploiting the DocumentId argument. This can lead to unauthorized access to certain resources or data within the affected system. The CVSS scores indicate a medium severity with potential confidentiality impact but no impact on integrity or availability.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves manipulation of the DocumentId argument in the /omnidocs/WebApiRequestRedirection file of Newgen OmniDocs up to version 12.0.00. Detection would typically involve monitoring HTTP requests to this endpoint for suspicious or malformed DocumentId parameters.
Specific detection commands or tools are not provided in the available information.
What immediate steps should I take to mitigate this vulnerability?
The CVE description does not provide explicit mitigation steps. However, general best practices include restricting access to the vulnerable endpoint, monitoring for unusual requests targeting the DocumentId parameter, and applying any available patches or updates from the vendor.
Since the vendor has not responded to the disclosure, consider implementing network-level protections such as web application firewalls (WAF) to block malicious requests.