LogicalDOC Community Edition EUVD-2026-97443

Requires a valid authenticated session on the LogicalDOC Community Edition instance (PR:L) - any low-privilege user account is sufficient, no administrative role needed. The attacker must reach the /zip-export servlet over the network and supply a folderId value for a folder they lack READ/DOWNLOAD permission on; folder IDs are sequential numeric identifiers and can be enumerated. No special non-default configuration is required and no user interaction from a victim is needed. The principal limiting factor is that exploitation cannot be performed anonymously - the attacker needs credentials - and the impact is confined to reading document contents (no write or availability effect). Affects versions through 9.3; patched builds restore the permission checks.

This is a genuine but moderate-priority confidentiality issue rather than a critical emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H) confirms network-reachable, low-complexity exploitation but requires authentication (PR:L) - any valid user account suffices, no admin rights needed. Impact is confidentiality-only (VC:H, VI:N/VA:N): an attacker reads documents they should not, but cannot modify or destroy data. No EPSS score, KEV listing, or public POC was provided in the intelligence, so there is no evidence of active or at-scale exploitation; the finding originates from a credible researcher (VulnCheck) and a vendor patch exists. The signals are internally consistent - low real-world urgency driven primarily by the authentication requirement and the limited (read-only) impact - but the lack of EPSS/KEV/POC data means exploitation likelihood cannot be quantified from the input and must be treated as unknown rather than low.

A low-privileged but authenticated LogicalDOC user (e.g. an employee restricted to one department's workspace) sends a request to the /zip-export servlet supplying the folderId of a confidential folder they have no READ or DOWNLOAD rights to. Because ZipExport.addFolderDocuments() omits the permission checks, the server streams back a ZIP archive of every document in that restricted folder. No public exploit code was identified in the provided intelligence, but the attack is a trivial parameter substitution against an authenticated endpoint.