Login Request a demo
Medium severity · published Oct 12, 2026
CVE-2026-109206
LogicalDOC Community Edition through 9.3 Username Enumeration via AvatarServlet
5.3
CVSS
0.2%
EPSS
No
On KEV
Description
LogicalDOC Community Edition through 9.3 contains a username enumeration vulnerability that allows unauthenticated attackers to identify valid accounts because the AvatarServlet (/avatar) performs no session validation. Attackers can supply usernames or numeric IDs in the userId parameter and compare 1x1 transparent images against real avatars to enumerate users and retrieve profile pictures.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LC
LogicalDOC Community Edition · LogicalDOC
through 9.3 · source: vendor
Affected product
LC
LogicalDOC Community Edition
LogicalDOC
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-109206
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-109206
technical-description
https://github.com/logicaldoc/community/discussions/119
patch
https://github.com/logicaldoc/community/commit/4e93a69526ae7fe50f670b85b3fc57181f3de3f7
technical-description
https://github.com/logicaldoc/community/blob/9.3/logicaldoc-webapp/src/main/java/com/logicaldoc/web/AvatarServlet.java#L63
product
https://github.com/logicaldoc/community
third-party-advisory
https://www.vulncheck.com/advisories/logicaldoc-community-edition-through-9.3-username-enumeration-via-avatarservlet
More from LogicalDOC Community Edition
8.8
CVE-2026-109199
LogicalDOC Community Edition through 9.3 Code Injection via Velocity sendAsEmail Template
8.3
CVE-2026-109201
LogicalDOC Community Edition through 9.3 Missing Authorization in DocumentService
7.5
CVE-2026-109205
LogicalDOC Community Edition through 9.3 Unauthenticated Upload Disk Exhaustion via UploadServlet
6.5
CVE-2026-109203
LogicalDOC Community Edition through 9.3 Missing Authorization via ConvertPdf Servlet
6.5
CVE-2026-109202
LogicalDOC Community Edition through 9.3 Missing Authorization via zip-export Servlet