docuForm Client CVE-2026-51923
HIGHSeverity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Authenticated low-privilege network IDOR (PR:L, AV:N, AC:L) giving cross-user read/modify so C:H/I:H; availability set N and RCE treated as unverified, matching described data impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
An Insecure Direct Object Reference (IDOR) vulnerability exists in docuForm GmbH Client v.11.11c allowing a remote attacker to execute arbitrary code via the user settings component, and modify or retrieve sensitive data associated with other users’ accounts.
AnalysisAI
Broken object-level authorization in docuForm GmbH Client v11.11c lets an authenticated remote user manipulate the user settings component to read and modify other users' account data, with the reporter additionally claiming this can escalate to arbitrary code execution. The flaw stems from user-controlled object references (CWE-639) that the application fails to authorize against the requesting session. There is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV; EPSS is low at 0.27% (18th percentile).
Technical ContextAI
docuForm is a German (docuform.de) document capture, forms and output-management product; the affected component is the Client's user settings function. The root cause is CWE-639, Authorization Bypass Through User-Controlled Key, i.e. a classic Insecure Direct Object Reference where a request parameter identifying a target user (or their settings object) is trusted without verifying that the object belongs to the authenticated caller. By substituting another user's identifier, the attacker pivots to that user's settings records. The RCE angle implied by the vendor tags would require that a mutable user-settings value (for example a path, template, script hook, or command field within those settings) is later evaluated or executed server-side - no CPE strings were supplied in the input, so exact affected package/platform identifiers cannot be enumerated from CPE data.
Affected ProductsAI
docuForm GmbH Client version 11.11c is the affected product per the MITRE-assigned CVE record; the affected-version range beyond that single build is not specified in the provided data and no CPE strings were supplied to bound it further. The vendor is docuForm GmbH (https://docuform.de); the reporting/research references point to ZeroBreach GmbH (https://ZeroBreach.de) and a writeup gist (https://gist.github.com/ZeroBreach-GmbH). No formal numbered vendor advisory URL was provided in the reference set.
RemediationAI
No vendor-released patch version was identified at time of analysis, so no exact fix build can be cited from the input data - contact docuForm GmbH (https://docuform.de) for a fixed release and monitor the researcher references (https://ZeroBreach.de and https://gist.github.com/ZeroBreach-GmbH) for technical detail. As compensating controls until a patch is confirmed: restrict network access to the Client's user-settings endpoints to trusted management networks or via VPN to shrink the remote attack surface; enforce least-privilege on application accounts since exploitation needs only low-privilege authentication; enable and review access logging on the user-settings component to detect object-reference tampering (requests where one user references another user's identifier); and, if the settings component exposes any executable/templating fields, disable or lock those fields to reduce the claimed RCE risk - noting the trade-off that locking settings fields may break legitimate per-user customization. Do not apply an invented version number; confirm the fix build directly with the vendor.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today