CVE-2026-109204
Received Received - Intake

Improper Authorization in LogicalDOC Community Edition Password Recovery

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
LogicalDOC Community Edition through 9.3 contains an improper authorization vulnerability in the PswRecovery servlet that fails to bind password recovery tickets to the requesting user. Attackers can obtain a ticket for their own account and reuse it with any userId, including administrators, to reset victims' passwords, lock them out, and reveal their email addresses.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109204
EUVD
EUVD-2026-97441

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
LogicalDOC LogicalDOC Community Edition 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-640 The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

LogicalDOC Community Edition through 9.3 has an improper authorization flaw in the PswRecovery servlet. Password recovery tickets are not bound to specific users, allowing attackers to reuse a valid ticket for any user ID, including administrators. This enables resetting passwords, locking users out, and revealing email addresses.

Detection Guidance

Check LogicalDOC Community Edition logs for unusual password recovery attempts or multiple password reset requests from the same IP address. Inspect the PswRecovery servlet for improper ticket handling or mismatched user IDs during recovery processes.

Impact Analysis

Attackers could reset your password, lock you out of your account, or expose your email address. If you are an administrator, attackers could take control of your account and access sensitive data.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's security requirements for safeguarding protected health information.

Mitigation Strategies

Update LogicalDOC Community Edition to version 9.3 or apply the patch from commit afc8554e6654865295bffc8f080c7cb899caf057. Ensure password recovery tickets are validated against the requesting user ID before processing resets.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109204. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart