This vulnerability affects Newgen OmniDocs up to version 12.0.00. It stems from improper handling of the connectionDetails argument in the /omnidocs/GetWebApiConfiguration functionality, leading to unauthorized information disclosure. The vulnerability can be triggered remotely without authentication but requires high attack complexity. The CVSS 4.0 base score is 6.3 (medium severity), reflecting network attack vector, high complexity, no privileges required, and low impact on confidentiality. No vendor advisory or patch information is available, and the vendor has not responded to the disclosure.

Successful exploitation could lead to unauthorized disclosure of information via the affected API endpoint. The impact is limited to information disclosure with low confidentiality impact as per the CVSS vector. There is no indication of privilege escalation, integrity, or availability impact. The attack is difficult to execute due to high complexity, and no active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch or workaround is available, organizations should monitor for updates from Newgen. Until a fix is available, consider restricting access to the /omnidocs/GetWebApiConfiguration endpoint to trusted users or networks if possible to reduce exposure.