PT-2026-113662

CVE-2026-106166

Published

2026-10-14

Updated

2026-10-14

Description by

CVSS 3.1

5.3

Medium

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions NEX-Forms versions 9.2.1 through 9.3.0

Description An Insecure Direct Object Reference (IDOR) exists due to missing authorization, ownership, and request-validation checks when updating stored form entries. This allows unauthenticated attackers to overwrite, permanently erase, reassign, or append to any previously submitted form entry by referencing its sequential identifier via a user-controlled key.

Recommendations Update NEX-Forms to version 9.3.1 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Farid Narimanov

Vendors

Affected products

Weakness enumeration

CWE-639: Authorization Bypass Through User-Controlled Key

Related identifiers