Username Enumeration Vulnerability in LogicalDOC Community Edition
CVE-2026-109206

6.9MEDIUM

Key Information:

Vendor

Logicaldoc

Status
Logicaldoc Community Edition
Vendor
CVE Published:
12 October 2026

What is CVE-2026-109206?

LogicalDOC Community Edition versions prior to 9.4 exhibit a vulnerability that allows unauthenticated attackers to exploit the AvatarServlet. Without session validation, attackers can input usernames or numeric IDs in the userId parameter, comparing 1x1 transparent images against actual avatars. This process enables them to enumerate valid usernames and gain unauthorized access to profile pictures, significantly compromising user privacy. A patch has been released to address this vulnerability.

Affected Version(s)

LogicalDOC Community Edition 0 <= 9.3

References

https://github.com/logicaldoc/community/discussions/119
technical-description
https://github.com/logicaldoc/community/commit/4e93a69526...
patch
https://github.com/logicaldoc/community/blob/9.3/logicald...
technical-description

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ikram-4
.