CVE-2026-109206
5.3MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-204
Impact
Unauthenticated remote attackers can enumerate valid usernames and download user avatars over the network. They only need access to the web interface to probe user IDs.
Root cause
The AvatarServlet endpoint (/avatar) fails to check for an active session and returns distinguishable responses for valid versus invalid users.
Affected systems
LogicalDOC Community Edition through 9.3
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Fix & remediation
Apply commit 4e93a69526ae7fe50f670b85b3fc57181f3de3f7 or upgrade to a patched release after 9.3 once available. As an interim workaround, block external access to the /avatar path at your reverse proxy or web application firewall.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
LogicalDOC Community Edition through 9.3 contains a username enumeration vulnerability that allows unauthenticated attackers to identify valid accounts because the AvatarServlet (/avatar) performs no session validation. Attackers can supply usernames or numeric IDs in the userId parameter and compare 1x1 transparent images against real avatars to enumerate users and retrieve profile pictures.
References
- https://github.com/logicaldoc/community
- https://github.com/logicaldoc/community/blob/9.3/logicaldoc-webapp/src/main/java/com/logicaldoc/web/AvatarServlet.java#L63
- https://github.com/logicaldoc/community/commit/4e93a69526ae7fe50f670b85b3fc57181f3de3f7
- https://github.com/logicaldoc/community/discussions/119
- https://www.vulncheck.com/advisories/logicaldoc-community-edition-through-9.3-username-enumeration-via-avatarservlet