PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-109201 LogicalDOC CVE debrief

LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in SoapDocumentService operations that allows authenticated users to access and modify unauthorized documents. This vulnerability can lead to data disclosure and tampering. Defenders should assess exposure and prioritize remediation, especially in environments where document access and modification are sensitive. The vulnerability can be exploited via SOAP or REST operations, and defenders should verify and remediate this vulnerability to prevent potential data disclosure and tampering.

Vendor
LogicalDOC
Product
LogicalDOC Community Edition
CVSS
HIGH 8.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-12
Original CVE updated
2026-10-12
Advisory published
2026-10-12
Advisory updated
2026-10-12

Who should care

Defenders and administrators of LogicalDOC Community Edition deployments should assess exposure and prioritize remediation, especially in environments where document access and modification are sensitive.

Why it matters

This vulnerability allows authenticated users to access and modify unauthorized documents in LogicalDOC Community Edition through 9.3, potentially leading to data disclosure and tampering.

  • Authenticated users may access unauthorized documents
  • Authenticated users may modify unauthorized documents
  • Defenders should verify and remediate this vulnerability to prevent potential data disclosure and tampering

Technical summary

The vulnerability allows authenticated users to access and modify unauthorized documents via SOAP or REST operations in LogicalDOC Community Edition through 9.3. This can be done by calling operations such as copy, getExtractedText, deleteVersion, reindex, deleteLink, or restore with sequential document IDs. The vulnerability is caused by a missing authorization check in the SoapDocumentService operations. Defenders should prioritize verifying and remediating this vulnerability in LogicalDOC Community Edition deployments, especially in environments where document access and modification are sensitive.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in LogicalDOC Community Edition deployments, especially in environments where document access and modification are sensitive.

Recommended defensive actions

  • Verify and remediate this vulnerability in LogicalDOC Community Edition deployments
  • Restrict access to sensitive documents and operations
  • Monitor for suspicious activity related to document access and modification
  • Implement compensating controls for exposed systems
  • Review asset inventory for affected deployments
  • Track exceptions and retest remediated assets
  • Plan vendor-supported updates or mitigations through normal change control

Evidence notes

The CVE record and source item provide details on the missing authorization vulnerability in LogicalDOC Community Edition through 9.3. The vulnerability allows authenticated users to access and modify unauthorized documents via SOAP or REST operations.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-109201 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-109201

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-109201 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-109201

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • LogicalDOC Community Edition through 9.3 Missing Authorization in DocumentService

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109201.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://github.com/logicaldoc/community/discussions/119

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/logicaldoc/community/commit/648047ee0ec95c294bb983e511fed60dbc67977f

    Supplemental source - patch

  • Source reference

    Unverified legacy reference

    URL: https://github.com/logicaldoc/community/blob/9.3/logicaldoc-webservice/src/main/java/com/logicaldoc/webservice/soap/endpoint/SoapDocumentService.java

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/logicaldoc/community

    Supplemental source - product

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/logicaldoc-community-edition-through-9.3-missing-authorization-in-documentservice

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.