CVE-2026-109204
MEDIUM
5,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM
6,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: low
Integrity: low
Availability: low
Description
AI Translation Available
LogicalDOC Community Edition through 9.3 contains an improper authorization vulnerability in the PswRecovery servlet that fails to bind password recovery tickets to the requesting user. Attackers can obtain a ticket for their own account and reuse it with any userId, including administrators, to reset victims' passwords, lock them out, and reveal their email addresses.
640
Weak Password Recovery Mechanism for Forgotten Password
IncompleteCommon Consequences
Security Scopes Affected:
Access Control
Availability
Integrity
Other
Potential Impacts:
Gain Privileges Or Assume Identity
Dos: Resource Consumption (Other)
Other
Applicable Platforms
All platforms may be affected
https://github.com/logicaldoc/community
https://github.com/logicaldoc/community/blob/9.3/logicaldoc-webapp/src/main/jav…
https://github.com/logicaldoc/community/commit/afc8554e6654865295bffc8f080c7cb8…
https://github.com/logicaldoc/community/discussions/119
https://www.vulncheck.com/advisories/logicaldoc-community-edition-through-9.3-f…