Missing Authorization Vulnerability in LogicalDOC Community Edition
CVE-2026-109201

8.7HIGH

Key Information:

Vendor

Logicaldoc

Status
Logicaldoc Community Edition
Vendor
CVE Published:
12 October 2026

What is CVE-2026-109201?

The LogicalDOC Community Edition, through version 9.3, is plagued by a missing authorization vulnerability in its SoapDocumentService operations. This flaw allows authenticated users to perform unauthorized actions on documents, such as copying, deleting, or modifying documents by exploiting SOAP or REST endpoints. Attackers are able to call methods with sequential document IDs, resulting in potential disclosure or tampering of sensitive documents without appropriate access rights.

Affected Version(s)

LogicalDOC Community Edition 0 <= 9.3

References

https://github.com/logicaldoc/community/discussions/119
technical-description
https://github.com/logicaldoc/community/commit/648047ee0e...
patch
https://github.com/logicaldoc/community/blob/9.3/logicald...
technical-description

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ikram-4
.