CVE-2026-109202 — LogicalDOC Community Edition through 9.3 Missing Authorization via zip-export Servlet
LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the zip-export servlet that allows authenticated users to export restricted folders by…
Published: 2026-10-12 · CVSS: 7.1 · CVSS 4.0
LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the zip-export servlet that allows authenticated users to export restricted folders by supplying a folderId parameter. Attackers can request /zip-export with a restricted folder ID, since ZipExport.addFolderDocuments() skips READ and DOWNLOAD permission checks, to download all of its documents in a ZIP archive.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7