CVE-2025-65742
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
An unauthenticated Broken Function Level Authorization (BFLA) vulnerability in Newgen OmniDocs v11.0 allows attackers to obtain sensitive information and execute a full account takeover via a crafted API request.
Risk Assessment
An unauthenticated attacker can access sensitive information and take over user accounts, potentially leading to data breach and system integrity compromise.
Recommendation
Apply the patches provided by the vendor and restrict API access with proper authorization mechanisms.
Other vulnerabilities in Newgen OmniDocs
See all- CVE-2026-5414Medium
A vulnerability was found in Newgen OmniDocs up to version 12.0.00 in the file /omnidocs/WebApiRequestRedirection. Manipulation of the DocumentId argument leads to improper control of resource identifiers, enabling remote attack. The exploit is publicly available.
- CVE-2026-5413Low
Newgen OmniDocs up to version 12.0.00 has a vulnerability in the file /omnidocs/GetWebApiConfiguration where manipulation of the connectionDetails argument leads to information disclosure. The attack is remote, with high complexity, and the exploit is publicly available.
Original NVD description (English source)
An unauthenticated Broken Function Level Authorization (BFLA) vulnerability in Newgen OmniDocs v11.0 allows attackers to obtain sensitive information and execute a full account takeover via a crafted API request.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS