Medium severity · published Oct 12, 2026
CVE-2026-109203
LogicalDOC Community Edition through 9.3 Missing Authorization via ConvertPdf Servlet
6.5
CVSS
0.2%
EPSS
No
On KEV
Description
LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the ConvertPdf servlet that allows authenticated users to download restricted PDF documents. Attackers can enumerate sequential docId values and use the version parameter to retrieve any PDF and its versions from folders they cannot access.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LC
LogicalDOC Community Edition · LogicalDOC
through 9.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-109203
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-109203
technical-description
https://github.com/logicaldoc/community/discussions/119
technical-description
https://github.com/logicaldoc/community/blob/9.3/logicaldoc-webapp/src/main/java/com/logicaldoc/web/ConvertPdf.java#L58
product
https://github.com/logicaldoc/community
third-party-advisory
https://www.vulncheck.com/advisories/logicaldoc-community-edition-through-9.3-missing-authorization-via-convertpdf-servlet
More from LogicalDOC Community Edition
8.8
CVE-2026-109199
LogicalDOC Community Edition through 9.3 Code Injection via Velocity sendAsEmail Template
8.3
CVE-2026-109201
LogicalDOC Community Edition through 9.3 Missing Authorization in DocumentService
7.5
CVE-2026-109205
LogicalDOC Community Edition through 9.3 Unauthenticated Upload Disk Exhaustion via UploadServlet
6.5
CVE-2026-109202
LogicalDOC Community Edition through 9.3 Missing Authorization via zip-export Servlet
6.5
CVE-2026-109170
LogicalDOC Community Edition through 9.3 HQL Injection via documents.xml indexed Parameter