What is the CVSS score of CVE-2025-69907?

CVE-2025-69907 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Newgen OmniDocs are affected by CVE-2025-69907?

An unauthenticated attacker can access sensitive cabinet metadata through Newgen OmniDocs without credentials, potentially exposing document structures, naming conventions, and organizational…

How to fix or mitigate CVE-2025-69907?

Within 24 hours: Identify all Newgen OmniDocs instances in your environment and restrict network access to the /omnidocs/GetListofCabinet endpoint to trusted internal networks only. Within 7 days: Implement WAF rules to require authentication tokens/session validation before allowing API requests to affected endpoints, and audit logs for unauthorized access attempts. Within 30 days: Contact Newgen for patch timeline, evaluate network segmentation options, and consider disabling the cabinet enumeration API if business operations permit.

Newgen OmniDocs CVE-2025-69907

HIGH

Improper Access Control (CWE-284)

2026-01-23 cve@mitre.org

Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 23, 2026 - 15:16 nvd

HIGH 7.5

DescriptionCVE.org

An unauthenticated information disclosure vulnerability exists in Newgen OmniDocs due to missing authentication and access control on the /omnidocs/GetListofCabinet API endpoint. A remote attacker can access this endpoint without valid credentials to retrieve sensitive internal configuration information, including cabinet names and database-related metadata. This allows unauthorized enumeration of backend deployment details and may facilitate further targeted attacks.

AnalysisAI

An unauthenticated information disclosure vulnerability exists in Newgen OmniDocs due to missing authentication and access control on the /omnidocs/GetListofCabinet API endpoint. [CVSS 7.5 HIGH]

Technical ContextAI

Classified as CWE-284 (Improper Access Control). An unauthenticated information disclosure vulnerability exists in Newgen OmniDocs due to missing authentication and access control on the /omnidocs/GetListofCabinet API endpoint. A remote attacker can access this endpoint without valid credentials to retrieve sensitive internal configuration information, including cabinet names and database-related metadata. This allows unauthorized enumeration of backend deployment details and may facilitate further targeted attacks.

Affected ProductsAI

An unauthenticated information disclosure vulnerability exists in Newgen OmniDocs due to missing authentication and access control on the /omnidocs/Ge