This vulnerability in Newgen OmniDocs (up to version 12.0.00) arises from improper control of resource identifiers due to manipulation of the DocumentId parameter in the /omnidocs/WebApiRequestRedirection endpoint. The flaw allows an unauthenticated remote attacker to potentially access or manipulate resources by altering this argument. The vendor has not issued any advisory or patch, and public exploit code is available. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality with no impact on integrity or availability.

An attacker can remotely manipulate the DocumentId parameter to improperly control resource identifiers, potentially leading to unauthorized access or resource manipulation. The impact is limited to confidentiality with low severity and no impact on integrity or availability. No known exploits are reported in the wild beyond the public exploit release.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, organizations should monitor for official updates from Newgen. In the meantime, consider restricting access to the affected endpoint and implementing compensating controls to limit exposure.