CVE-2026-51923 describes an IDOR vulnerability in docuForm GmbH Client version 11.11c. This flaw permits a remote attacker with low privileges to exploit the user settings component to execute arbitrary code and to retrieve or alter sensitive information belonging to other users. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). The CVSS v3.1 base score is 8.1, indicating a high severity with network attack vector, low attack complexity, requiring privileges but no user interaction, and resulting in high confidentiality and integrity impact without affecting availability. No patch or vendor advisory is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows an attacker with limited privileges to execute arbitrary code remotely and to access or modify sensitive data associated with other user accounts. This compromises confidentiality and integrity of user data but does not impact system availability. The vulnerability could lead to unauthorized data disclosure and potential privilege escalation within the affected application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected user settings component and monitor for suspicious activity. Avoid granting unnecessary privileges to users to reduce exploitation risk.