LogicalDOC Community Edition EUVD-2026-97444

Exploitation requires a valid authenticated LogicalDOC session; any low-privilege user account suffices (PR:L), with no administrative rights and no user interaction needed. The attacker must reach the SOAP endpoint or the /services/rest/document REST interface and invoke the affected SoapDocumentService operations (copy, getExtractedText, deleteVersion, reindex, deleteLink, or restore) supplying document IDs they are not authorized for; because IDs are sequential, enumeration is trivial. The primary limiting factor is the authentication requirement - an attacker needs credentials or a provisioned account - so environments that restrict account creation and segregate users reduce realistic exposure. The flaw affects default configurations of LogicalDOC Community Edition versions through 9.3.

This is a credible, actionable issue but short of top-tier emergency. The CVSS 4.0 base score of 8.7 (High) reflects AV:N (network-reachable SOAP/REST endpoint), AC:L (trivial exploitation via sequential IDs), PR:L (a valid authenticated account is required), UI:N (no user interaction), and high confidentiality/integrity impact with low availability impact (VC:H/VI:H/VA:L) and no scope change. The weakness (CWE-862 Missing Authorization) is a classic IDOR/broken-access-control pattern: once any authenticated user is present, exploitation is essentially deterministic because document IDs are sequential and guessable. However, no EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no evidence of active exploitation or in-the-wild weaponization. The practical risk is therefore moderated by two factors: the PR:L authentication prerequisite (an attacker needs at least a low-privilege account) and the niche deployment footprint of the product. Net: a real priority for organizations running LogicalDOC Community Edition that allow multiple or self-service user accounts, but not a mass-exploitation internet emergency given the authentication gate and limited prevalence. No conflicting signals were observed between the CVSS vector and the description - both agree on network-reachable, authenticated access.

A low-privileged but authenticated LogicalDOC user calls SoapDocumentService operations (e.g., copy, getExtractedText, deleteVersion, or restore) against sequential document IDs they do not own, bypassing folder/document permission checks. Because the service never verifies authorization on the target document, the attacker can read confidential documents, tamper with content, or delete versions belonging to other users or tenants. No public exploit code was identified at time of analysis, but the attack requires only basic knowledge of the SOAP or /services/rest/document interface and ID enumeration.