CVE-2026-109202 LogicalDOC CVE debrief

Who should care

Defenders responsible for LogicalDOC Community Edition deployments, particularly those with restricted folders containing sensitive documents, should assess exposure and potential impact.

Why it matters

Defenders should prioritize verifying exposure and assessing potential impact of the missing authorization vulnerability in LogicalDOC Community Edition through 9.3, focusing on authenticated users and restricted folder access.

• Potential unauthorized access to sensitive documents in restricted folders
• Possible data leakage through ZIP archive exports
• Need for verification of authenticated user access controls
• Potential for monitoring and logging to detect abuse

Technical summary

The LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the zip-export servlet. This allows authenticated users to export restricted folders by supplying a folderId parameter, potentially leading to unauthorized access to sensitive documents. The vulnerability arises because ZipExport.addFolderDocuments() skips READ and DOWNLOAD permission checks. As a result, attackers can request /zip-export with a restricted folder ID to download all of its documents in a ZIP archive. Defenders should prioritize verifying exposure and assessing potential impact, focusing on authenticated users and restricted folder access.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, focusing on authenticated users and restricted folder access.

Recommended defensive actions

• Verify exposure by checking if authenticated users can access restricted folders via the zip-export servlet
• Assess potential impact by evaluating the sensitivity of documents in restricted folders
• Implement compensating controls, such as monitoring and logging, to detect potential abuse
• Apply the patch provided by the vendor, if available
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the missing authorization vulnerability in LogicalDOC Community Edition through 9.3. The vulnerability allows authenticated users to export restricted folders by supplying a folderId parameter.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.