CVE-2026-109201: LogicalDOC Community Edition through 9.3 Missing Authorization in DocumentService
LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in SoapDocumentService operations that allows authenticated users to access and modify unauthorized documents. Attackers can call copy, getExtractedText, deleteVersion, reindex, deleteLink, or restore via SOAP or /services/rest/document with sequential document IDs to disclose, delete, or tamper with documents.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs to be authenticated as a LogicalDOC Community Edition user. No additional user interaction is required, and the vulnerable interfaces are reachable over the network.
Which interfaces and actions are affected?
The affected operations are exposed through SOAP and the /services/rest/document endpoint. The listed actions are copy, getExtractedText, deleteVersion, reindex, deleteLink, and restore.
What can an attacker do with a successful exploit?
By using sequential document IDs, an authenticated attacker can access documents they are not authorized to access and may disclose extracted text, delete document versions, or tamper with documents and links.
How can I determine whether my deployment is affected?
LogicalDOC Community Edition through version 9.3 is affected. Review whether authenticated users can invoke the listed SOAP or REST document operations against document IDs outside their authorized scope.