Vulnerability · Published Oct 12, 2026 · Assigned by VulnCheck

CVE-2026-109204LogicalDOC Community Edition through 9.3 Forced Password Reset via Unbound PswRecovery Ticket

Medium 6.3

In plain English

A medium-severity security flaw in LogicalDOC Community Edition from LogicalDOC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.2%top 90.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

LogicalDOC Community Edition through 9.3 contains an improper authorization vulnerability in the PswRecovery servlet that fails to bind password recovery tickets to the requesting user. Attackers can obtain a ticket for their own account and reuse it with any userId, including administrators, to reset victims' passwords, lock them out, and reveal their email addresses.

Affected products (as reported)

Vendor	Product	Versions
LogicalDOC	LogicalDOC Community Edition	0 – through 9.3

Weakness: CWE-640 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

https://github.com/logicaldoc/community/discussions/119 technical-description
Patch Commit patch
https://github.com/logicaldoc/community/blob/9.3/logicaldoc-webapp/src/main/java/com/logicaldoc/web/PswRecovery.java#L101 technical-description
https://github.com/logicaldoc/community product
VulnCheck Advisory: LogicalDOC Community Edition through 9.3 Forced Password Reset via Unbound PswRecovery Ticket third-party-advisory