CVE-2026-109203
6.5MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-862
Impact
Authenticated users can download any restricted PDF document across folders they lack permissions for. An attacker only needs basic user credentials to enumerate sequential document IDs and fetch the files.
Root cause
The ConvertPdf servlet fails to perform authorization checks on the requested docId and version parameters before returning PDF content.
Affected systems
LogicalDOC Community Edition through 9.3
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Fix & remediation
No patched version is specified; restrict or block HTTP access to the ConvertPdf servlet mapping in your reverse proxy or web application firewall until a patch is available.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the ConvertPdf servlet that allows authenticated users to download restricted PDF documents. Attackers can enumerate sequential docId values and use the version parameter to retrieve any PDF and its versions from folders they cannot access.
References
- https://github.com/logicaldoc/community
- https://github.com/logicaldoc/community/blob/9.3/logicaldoc-webapp/src/main/java/com/logicaldoc/web/ConvertPdf.java#L58
- https://github.com/logicaldoc/community/discussions/119
- https://www.vulncheck.com/advisories/logicaldoc-community-edition-through-9.3-missing-authorization-via-convertpdf-servlet