Is there a public PoC exploit available for EUVD-2026-18487?

Yes, a public proof-of-concept exploit is available for EUVD-2026-18487. Prioritise patching immediately. EPSS: 0.0%.

Omnidocs EUVD-2026-18487

Q: What is the CVSS score of EUVD-2026-18487?

EUVD-2026-18487 has a CVSS 4.0 base score of 2.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-5413 LOW

Information Exposure (CWE-200)

2026-04-02 VulDB

Information Disclosure Omnidocs

2.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.9 LOW

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.3 (MEDIUM) 2.9 (LOW)

PoC Detected

Apr 03, 2026 - 16:10 vuln.today

Public exploit code

EUVD ID Assigned

Apr 02, 2026 - 18:15 euvd

EUVD-2026-18487

Analysis Generated

Apr 02, 2026 - 18:15 vuln.today

CVE Published

Apr 02, 2026 - 17:45 nvd

MEDIUM 6.3

DescriptionCVE.org

A vulnerability was identified in Newgen OmniDocs up to 12.0.00. Affected by this vulnerability is an unknown functionality of the file /omnidocs/GetWebApiConfiguration. The manipulation of the argument connectionDetails leads to information disclosure. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitation appears to be difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Information disclosure in Newgen OmniDocs up to version 12.0.00 allows remote attackers without authentication to extract sensitive data by manipulating the connectionDetails parameter in the /omnidocs/GetWebApiConfiguration endpoint. The vulnerability has a CVSS score of 6.3 with high attack complexity, and publicly available exploit code exists; however, no confirmed active exploitation has been reported. The vendor did not respond to early disclosure notification.

Technical ContextAI

The vulnerability resides in the GetWebApiConfiguration functionality of Newgen OmniDocs, a document management system. The affected endpoint fails to properly validate or sanitize the connectionDetails argument, leading to information disclosure through an improper restriction of rendered user interface elements (CWE-200). This is a remote, unauthenticated attack vector (CVSS AV:N, PR:N, UI:N) that requires high attack complexity (AC:H), suggesting the exploitation path involves specific conditions or multi-step manipulation. The CPE indicates all versions up to and including 12.0.00 are affected by this input validation flaw.

RemediationAI

No vendor-released patch identified at time of analysis. Organizations running Newgen OmniDocs up to version 12.0.00 should contact Newgen directly to inquire about security updates or patched versions beyond 12.0.00, given the vendor's documented non-responsiveness to this disclosure. In the interim, implement network-level controls to restrict access to the /omnidocs/GetWebApiConfiguration endpoint, limiting exposure to trusted internal networks only. Review access logs for suspicious connectionDetails parameter manipulation attempts. Refer to VulDB submission (https://vuldb.com/submit/781722) for additional context and consider evaluating whether upgrading to a newer major version of OmniDocs is feasible if patched releases are unavailable.