EUVD-2026-97439
GHSA-g7j6-49p3-h792
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach /avatar endpoint unauthenticated
-
DeliveryEnumerate userId values (names and numeric IDs)
-
ExploitCompare real avatar vs 1x1 placeholder response
-
ExecutionConfirm valid accounts and harvest profile images
-
ImpactFeed account list into password-spray or phishing
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V6 - Authentication Response uniformity
|
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of LogicalDOC Community Edition (through 9.3), because the AvatarServlet (/avatar) performed no session validation and processed the userId parameter for any caller. The only practical prerequisite is network reachability of the /avatar endpoint. Limiting factors that bound real-world risk: the vulnerability discloses only account existence and profile images (confidentiality-low), grants no authentication, credentials, or write access, and is remediated once the instance runs the patched build that enforces SessionManager.isOpen() and returns the default avatar to unauthenticated requests. |
| Impact | This is a genuine but low-to-moderate priority issue, not a critical one. The CVSS 4.0 base score of 6.9 (Medium) is driven by the network-reachable, unauthenticated, low-complexity vector (AV:N/AC:L/AT:N/PR:N/UI:N) combined with a confidentiality-only impact (VC:L, with VI:N/VA:N) - meaning the attacker gains limited information disclosure (valid usernames/IDs and profile images) but no integrity or availability impact and no code execution. All signals are consistent and point to an information-disclosure primitive rather than a direct compromise: CWE-204 (observable response discrepancy) matches the described 1x1-transparent-vs-real-avatar oracle. No EPSS score, CISA KEV listing, SSVC decision data, or explicit POC flag was supplied in the input, so exploitation-probability and real-world-exploitation signals are UNKNOWN and cannot be asserted. The absence of KEV/EPSS data means this must be prioritized on vector and impact alone: easy to exploit remotely without authentication, but the payoff is reconnaissance (account enumeration feeding later password-spraying or phishing) rather than a standalone breach. Treat it as a patch-promptly hardening item for internet-exposed instances, not an emergency. |
| Exploit ScenarioDerived | An unauthenticated attacker who can reach a LogicalDOC Community Edition instance repeatedly requests /avatar with incrementing numeric values or guessed names in the userId parameter and observes whether the server returns a real avatar image versus a 1x1 transparent/default placeholder. This oracle lets them confirm which usernames and user IDs exist and harvest profile pictures, building a validated account list for follow-on password spraying, credential stuffing, or targeted phishing. Exploitation is trivial (AV:N/AC:L/PR:N/UI:N) and scriptable; the fixed code confirms the servlet previously performed no session check. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Username enumeration in LogicalDOC Community Edition through 9.3 allows remote unauthenticated attackers to determine which accounts exist and to retrieve their profile pictures by requesting the /avatar endpoint with candidate usernames or numeric IDs. The AvatarServlet performed no session validation, so the only prerequisite is network reachability of the endpoint; identification relies on distinguishing a generic 1x1 transparent image returned for unknown identifiers from a real avatar returned for valid accounts. The disclosure is limited to account existence and profile imagery (confidentiality-low, no authentication, credentials, or write access granted), making this a low-to-moderate priority issue rather than a critical one; no public exploit code was identified at time of analysis and the issue is not known to be actively exploited.
RemediationAI
Apply the upstream fix commit 4e93a69526ae7fe50f670b85b3fc57181f3de3f7 (referenced from https://github.com/logicaldoc/community/commit/4e93a69526ae7fe50f670b85b3fc57181f3de3f7) or install a LogicalDOC Community Edition build that includes it; vendor advisory data states a patch is available, but no exact patched release number was provided in the intelligence, so validate the running build contains the SessionManager.get().isOpen(sid) check in AvatarServlet before considering the instance fixed. After upgrading, verify that anonymous requests to /avatar return the generic UserUtil.DEFAULT_AVATAR_IMAGE rather than a real avatar and that no distinct response is produced for valid versus invalid userId values. If immediate patching is not possible, the most effective compensating control is to restrict the /avatar endpoint at the reverse proxy or servlet filter so only requests carrying a valid authenticated session are forwarded - the trade-off is that unauthenticated pages that render default avatars may break or show broken images, and care must be taken not to blanket-block the path in a way that also breaks avatar display for logged-in users. Additional measures include rate-limiting and alerting on /avatar request patterns that iterate userId values, since enumeration attempts produce high-volume, low-variance 200/404 sequences; this does not prevent enumeration on its own but supports detection and blocking after the fact. Because the disclosed information (valid usernames plus profile images) feeds credential-stuffing, password-spraying, and targeted phishing, treat any window of exposure as a reason to enforce strong authentication controls such as MFA and lockout thresholds, and consider rotating or hiding discoverable usernames where the deployment allows it. Blocking network access to /avatar from untrusted networks is a valid stopgap for internet-facing deployments, with the same functional side effect of losing avatar rendering for off-network users.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-204 (Observable Response Discrepancy) within the Java servlet com.logicaldoc.web.AvatarServlet, exposed at the /avatar path in the logicaldoc-webapp module. The servlet's doGet handler read the userId request parameter - which accepts either a username or a numeric user ID - and passed it directly to UserUtil.getAvatarImage(id) without first calling SessionManager to validate that the caller held an open session; when no stored avatar was found it went on to UserDAO.get().findById(Long.parseLong(id)) and generated a default avatar. Because the response body and content type differed between a valid account (a real avatar, often a data:image/... base64 payload decoded and written to the output stream) and an invalid one (a 1x1 transparent placeholder or an error), an unauthenticated remote caller could binary-search the user namespace by comparing returned images. The upstream fix adds a check on SessionManager.get().getSessionId(request) and SessionManager.get().isOpen(sid), falling back to the constant UserUtil.DEFAULT_AVATAR_IMAGE for unauthenticated or unauthenticated-session requests; that constant was additionally changed from private to public static so the servlet can reference it, confirming the intended behavior is now 'always return the generic avatar unless an authenticated session exists'. The CVSS 4.0 vector supplied with the CVE (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) is consistent with the independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N): remotely reachable, low attack complexity, no privileges or user interaction required, and confidentiality-only impact at the low level.
Know when Logicaldoc gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Endpoint is remotely reachable with no session check (AV:N/AC:L/PR:N/UI:N); only limited username/avatar disclosure, so C:L and I:N/A:N.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
LogicalDOC Community Edition through 9.3 contains a username enumeration vulnerability that allows unauthenticated attackers to identify valid accounts because the AvatarServlet (/avatar) performs no session validation. Attackers can supply usernames or numeric IDs in the userId parameter and compare 1x1 transparent images against real avatars to enumerate users and retrieve profile pictures.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Logicaldoc
View allLogicalDoc before 8.3.3 could allow an attacker to upload arbitrary files, leading to command execution or retrieval of
LogicalDoc Community Edition 7.5.3 and prior is vulnerable to XXE when indexing XML documents. Rated high severity (CVSS
LogicalDoc Community Edition 7.5.3 and prior contain an Incorrect access control which could leave to privilege escalati
A local privilege elevation vulnerability exists in the file system permissions of LogicalDoc 8.5.1 installation. Rated
LogicalDoc before 8.3.3 allows /servlet.gupld Directory Traversal, a different vulnerability than CVE-2020-9423 and CVE-
LogicalDOC Community Edition 8.x before 8.2.1 has a path traversal vulnerability that allows reading arbitrary files and
LogicalDoc before 8.3.3 allows SQL Injection. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitab
LogicalDoc Community Edition 7.5.3 and prior is vulnerable to an XSS when using preview on HTML document. Rated medium s
The API used to interact with documents in the application contains two endpoints with a flaw that allows an authenticat
Unauthenticated multipart uploads to the LogicalDOC Community Edition /upload endpoint (through version 9.3) let remote
Authenticated remote code execution in LogicalDOC Community Edition through 9.3 allows any user with a valid account to
Missing authorization in LogicalDOC Community Edition through 9.3 allows any authenticated low-privilege user to disclos
Exploit-DB