Newgen OmniDocs Unauthenticated Broken Function Level Authorization Vulnerability Allowing Account Takeover

A critical unauthenticated Broken Function Level Authorization vulnerability has been identified in Newgen OmniDocs version 11.0. This vulnerability allows remote users to access the LDAP administration interface and invoke backend API endpoints without authentication. As a result, attackers can unauthorizedly view and modify LDAP domain configurations, potentially leading to a full account takeover.

Impact

Exploitation of this vulnerability could result in unauthorized access to the LDAP admin interface, allowing for unauthorized viewing and modification of LDAP domain configurations. This could facilitate a full account takeover.

Reproduction

To reproduce this vulnerability, access the LDAP Admin UI without authentication by navigating to the appropriate endpoint. The OmniDocs LDAP Admin Desktop will load successfully, indicating that authentication is not required.