LogicalDOC Community Edition CVE-2026-109170

Requires a valid authenticated LogicalDOC Community Edition account (through v9.3) holding read permission on at least one folder (PR:L). The attacker then supplies a malicious 'indexed' request parameter to DocumentsDataServlet (the documents.xml data endpoint), which is concatenated unvalidated into the HQL query (query.append(" and A.indexingStatus = %s")). No non-default configuration or special feature toggle is needed - the vulnerable servlet is part of the standard web application. The primary limiting factor is the authentication requirement (any read-access user suffices); there is no user-interaction requirement, and impact is restricted to confidentiality (metadata/database read), not modification or denial of service.

Signals are moderately consistent and point to a real but bounded data-confidentiality issue rather than a critical priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with impact confined to confidentiality (VC:H, VI:N, VA:N) - consistent with the description, which limits the flaw to reading restricted document metadata and database contents via HQL injection (CWE-89). The score of 7.1 (High) is driven entirely by the confidentiality impact; there is no integrity or availability impact and no scope change, so this is not a remote-code-execution or takeover scenario. No EPSS probability was provided, the CVE is NOT in CISA KEV, and no POC was supplied, so exploitation status is: no public exploit identified at time of analysis. The key limiting factor is PR:L - an attacker must already hold a valid authenticated account with read access to at least one folder, which lowers real-world exploitability compared to an unauthenticated flaw. Mitigating this, a vendor patch is confirmed available (parameterizing the query), and the fix commit publicly reveals the exact vulnerable code path, which could accelerate exploit development. Net: a genuine authenticated information-disclosure bug worth patching, but lower urgency than an unauthenticated or RCE-class issue.

A low-privileged but authenticated LogicalDOC user who has read access to any single folder sends a request to DocumentsDataServlet with a crafted 'indexed' parameter containing a boolean HQL expression. Because the parameter is concatenated directly into the HQL query, the attacker bypasses folder-scope and read-permission checks and enumerates metadata of documents they should not see, ultimately extracting broader database contents. No public exploit code is identified, but the vendor fix commit discloses the exact vulnerable line, lowering the barrier to weaponization.