CVE-2026-51923
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
An IDOR vulnerability in docuForm GmbH Client v.11.11c allows a remote attacker to execute arbitrary code via the user settings component and modify or retrieve sensitive data from other users' accounts.
Risk Assessment
An attacker can compromise user accounts, steal confidential data, or execute malicious code, leading to a breach of system integrity and confidentiality.
Recommendation
Immediately update the software to the latest version and implement object-level access control mechanisms (e.g., random session identifiers).
Other vulnerabilities in docuForm GmbH Client
See all- CVE-2026-51925High
A Local File Inclusion (LFI) vulnerability exists in docuForm GmbH Client v.11.11c in the dfm-menu_report.php component. A remote attacker can exploit this flaw to read arbitrary files on the server, including sensitive configuration files, source code or system files, potentially leading to arbitrary code execution.
- CVE-2026-51924High
A vulnerability in docuForm GmbH Client version 11.11c allows a remote attacker to execute arbitrary code via the file upload mechanism and the report.php component.
Original NVD description (English source)
An Insecure Direct Object Reference (IDOR) vulnerability exists in docuForm GmbH Client v.11.11c allowing a remote attacker to execute arbitrary code via the user settings component, and modify or retrieve sensitive data associated with other users’ accounts.