CVE-2026-109204: LogicalDOC Community Edition through 9.3 Forced Password Reset via Unbound PswRecovery Ticket
LogicalDOC Community Edition through 9.3 contains an improper authorization vulnerability in the PswRecovery servlet that fails to bind password recovery tickets to the requesting user. Attackers can obtain a ticket for their own account and reuse it with any userId, including administrators, to reset victims' passwords, lock them out, and reveal their email addresses.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker needs a valid account with permission to use the password-recovery workflow. They can obtain a recovery ticket for their own account and submit it with another user's userId.
Which users are at risk?
Any account whose userId can be supplied to the vulnerable password-recovery servlet may be targeted, including administrator accounts. A successful attack can reset the victim's password, lock the victim out, and disclose the victim's email address.
Are default deployments affected?
The affected component is the PswRecovery servlet in LogicalDOC Community Edition through version 9.3. The provided information does not identify a configuration prerequisite beyond the availability of the password-recovery workflow.
How can I determine whether my instance is vulnerable?
Instances running LogicalDOC Community Edition through 9.3 should be treated as affected. The vulnerable behavior is accepting a password-recovery ticket obtained for one account together with a different user's userId.