CVE-2026-109204 Details
Description
LogicalDOC Community Edition through 9.3 contains an improper authorization vulnerability in the PswRecovery servlet that fails to bind password recovery tickets to the requesting user. Attackers can obtain a ticket for their own account and reuse it with any userId, including administrators, to reset victims' passwords, lock them out, and reveal their email addresses.
A vulnerability exists in LogicalDOC Community Edition versions through 9.3 in the PswRecovery servlet. The issue arises from an improper authorization mechanism that does not properly associate password recovery tickets with the user requesting them. This flaw enables attackers to obtain a password recovery ticket for their own account and use it to reset passwords for any user, including administrators. The vulnerability also allows for locking out the affected user and disclosing their email address.
Users can update to LogicalDOC Community Edition 9.3.1, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 12, 2026CISA-ADP
Assessed Oct 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/logicaldoc/community | [email protected] | Source CodeVendor |
| https://github.com/logicaldoc/community/blob/9.3/logicaldoc-webapp/src/main/java/com/logicaldoc/web/PswRecovery.java#L101 | [email protected] | Source CodeVendor |
| https://github.com/logicaldoc/community/commit/afc8554e6654865295bffc8f080c7cb899caf057 | [email protected] | Source CodeVendor |
| https://github.com/logicaldoc/community/discussions/119 | [email protected] | BundleIssue TrackingTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/logicaldoc-community-edition-through-9.3-forced-password-reset-via-unbound-pswrecovery-ticket | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-640 | Weak Password Recovery Mechanism for Forgotten Password | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| LogicalDOC Community Edition | <= 9.3.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 18, 2026 | CVE Modified | CISA-ADP |
| Oct 12, 2026 | New CVE Received | [email protected] |