LogicalDOC EUVD-2026-97441

Exploitation requires the attacker to hold a valid LogicalDOC account (PR:L) in order to obtain a legitimate password-recovery ticket via the PswRecovery servlet; the limiting factor is therefore the ability to register or otherwise acquire any low-privileged account. Once a ticket is held, no special configuration is needed - the servlet accepts an arbitrary userId parameter and does not bind the ticket to the requesting user, so any user (including administrators) can be targeted against default configurations through version 9.3. The practical constraint on real-world risk is this authentication prerequisite plus whether self-service account registration or exposed login is reachable by the attacker.

This is a medium-severity (CVSS 5.3, CVSS:4.0 base) improper authorization flaw (CWE-640, broken password recovery) in LogicalDOC Community Edition. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates remote, low-complexity exploitation requiring only a low-privileged authenticated account, with no user interaction - a realistic barrier that is low in deployments allowing self-registration but higher where accounts are tightly provisioned. Impact is rated Low across confidentiality, integrity, and availability (VC:L/VI:L/VA:L), yet the described outcome is functionally an account-takeover primitive against arbitrary users including administrators, so the business impact can exceed what the Low ratings suggest. No EPSS score was provided and the CVE is not listed in CISA KEV, so there is no probabilistic or confirmed-exploitation signal; no public proof-of-concept was supplied in the input either, though a vendor patch commit and a VulnCheck advisory precisely document the root cause. Overall this is a credible, patch-now issue for exposed LogicalDOC instances (low attack complexity, admin-password-reset potential) rather than a mass-exploitation emergency, given the authentication prerequisite, limited product footprint, and absence of KEV/EPSS escalation signals. EPSS is simply absent (not low) - do not treat its omission as evidence of low risk.

An attacker who holds or self-registers any low-privileged LogicalDOC account requests a legitimate password-recovery ticket for their own account, then replays that ticket while substituting an administrator's userId. Because the PswRecovery servlet never verifies the ticket belongs to the supplied userId, the server generates and emails a new password for the admin, forcibly resetting it, locking out the legitimate admin, and disclosing the victim's email address. No public exploit was identified at time of analysis, but the flaw is trivially reproducible from the published patch diff.