LogicalDOC Community Edition CVE-2026-109203

Exploitation requires a valid authenticated LogicalDOC Community Edition account (PR:L) reaching the ConvertPdf servlet over the network; no administrative rights, no user interaction, and no non-default configuration are needed since the flaw is a missing per-document authorization check in the servlet itself. The attacker leverages the docId parameter (enumerable via sequential IDs) together with the version parameter to retrieve PDFs from folders outside their permission scope. The primary limiting factor is that an attacker must already possess credentials - this is not unauthenticated - and impact is confined to disclosure of PDF documents and their versions (no write/modify or denial-of-service capability). Affected scope is LogicalDOC Community Edition through version 9.3.

This is a moderate, authenticated information-disclosure flaw rather than a top-tier emergency. The vendor/VulnCheck CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H) is internally consistent with the description: network-reachable, low attack complexity, low privileges required (any authenticated account), no user interaction, and high confidentiality impact with zero integrity or availability impact. The core risk driver is the broken access control (CWE-862) allowing docId enumeration across folders the user cannot legitimately access - meaning a single low-privilege account can harvest confidentiality-restricted documents system-wide. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no signal of active or widespread exploitation; the references point to source code and a vendor discussion rather than exploit tooling. The practical limiting factor is the PR:L requirement - an attacker must already hold valid credentials - which caps this below the severity of an unauthenticated breach. Net assessment: a real and credible internal/insider or post-credential-theft data-exposure risk worth patching promptly, but not a mass-exploitation 'drop everything' item given the authentication prerequisite and absence of exploitation signals.

A user with any valid LogicalDOC account (or an attacker who has phished/compromised one low-privilege login) calls the ConvertPdf servlet while iterating sequential docId values and the version parameter. Because the servlet omits a per-document authorization check, the attacker receives PDF documents and historical versions stored in folders they were never granted access to, enabling bulk exfiltration of confidential files. No public exploit code was identified at time of analysis, and the low attack complexity (AC:L) means scripting the enumeration is trivial.