CVE-2026-109202
Received Received - Intake

LogicalDOC Zip Export Missing Authorization Vulnerability

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the zip-export servlet that allows authenticated users to export restricted folders by supplying a folderId parameter. Attackers can request /zip-export with a restricted folder ID, since ZipExport.addFolderDocuments() skips READ and DOWNLOAD permission checks, to download all of its documents in a ZIP archive.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109202
EUVD
EUVD-2026-97443

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
LogicalDOC LogicalDOC Community Edition 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

LogicalDOC Community Edition through 9.3 has a missing authorization vulnerability in the zip-export servlet. Authenticated users can export restricted folders by providing a folderId parameter. The system skips READ and DOWNLOAD permission checks, allowing attackers to download all documents in a restricted folder via a ZIP archive by requesting /zip-export with the folder ID.

Detection Guidance

Check if the zip-export servlet is accessible by sending a GET request to /zip-export with a folderId parameter. If the server responds with a ZIP file without proper authorization, the vulnerability may be present.

Impact Analysis

This vulnerability allows unauthorized access to sensitive documents in restricted folders. Attackers with valid credentials can exfiltrate confidential data, leading to data breaches, loss of intellectual property, or compliance violations. The impact includes potential financial loss, reputational damage, and legal consequences depending on the exposed data.

Compliance Impact

This vulnerability can lead to non-compliance with GDPR, HIPAA, and other privacy regulations. Unauthorized access to personal or health data violates confidentiality requirements, potentially resulting in fines, penalties, or mandatory breach notifications. Organizations must ensure proper access controls to maintain regulatory compliance.

Mitigation Strategies

Update LogicalDOC Community Edition to the latest version that patches this vulnerability. If an update is not available, restrict access to the /zip-export servlet or implement proper permission checks in the application.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109202. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart