CVE-2026-109203 — LogicalDOC Community Edition through 9.3 Missing Authorization via ConvertPdf Servlet
LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the ConvertPdf servlet that allows authenticated users to download restricted PDF docu…
Published: 2026-10-12 · CVSS: 7.1 · CVSS 4.0
LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the ConvertPdf servlet that allows authenticated users to download restricted PDF documents. Attackers can enumerate sequential docId values and use the version parameter to retrieve any PDF and its versions from folders they cannot access.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7