CVE-2026-109201 in Community Edition
Summary
by MITRE • 10/12/2026
LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in SoapDocumentService operations that allows authenticated users to access and modify unauthorized documents. Attackers can call copy, getExtractedText, deleteVersion, reindex, deleteLink, or restore via SOAP or /services/rest/document with sequential document IDs to disclose, delete, or tamper with documents.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in LogicalDOC Community Edition versions through 9.3 represents a critical failure in access control mechanisms within the application's backend services. Specifically, this flaw resides in the SoapDocumentService operations and associated REST endpoints, where the system fails to properly verify whether an authenticated user has the necessary permissions for specific document actions. This missing authorization issue allows any validly authenticated attacker to bypass intended security restrictions by directly manipulating sequential document identifiers. The core technical deficiency lies in the application's reliance on predictable or sequentially generated Document IDs without implementing robust server-side checks that validate the relationship between the requesting user and the target resource. Consequently, an adversary can iterate through these ID sequences to discover documents belonging to other users or administrative accounts, effectively bypassing the intended isolation boundaries of the multi-tenant environment.
The operational impact of this vulnerability is severe, as it grants attackers the ability to perform a wide range of destructive and intrusive actions against unauthorized resources. By exploiting the lack of authorization checks on endpoints such as copy, getExtractedText, deleteVersion, reindex, deleteLink, and restore via SOAP or /services/rest/document interfaces, an attacker can read sensitive content through text extraction services, duplicate confidential files to exfiltrate them later, permanently remove critical data by deleting versions or links, and potentially disrupt system integrity by forcing re-indexing operations. This capability transforms a standard authentication requirement into a trivial barrier for malicious actors who possess valid credentials, whether obtained through phishing, credential stuffing, or other means of account compromise. The ability to modify document states without permission undermines the confidentiality, integrity, and availability guarantees that the software is designed to provide.
From a classification perspective, this vulnerability aligns with CWE-284, which describes Improper Access Control, specifically highlighting failures in authorization checks where users can access resources they are not permitted to view or manipulate. It also maps directly to MITRE ATT&CK technique T1078, Valid Accounts, as the exploitation relies on legitimate credentials being used for unauthorized purposes due to flawed backend logic rather than credential theft alone. Furthermore, the method of iterating through sequential IDs relates to CWE-285, Improper Authorization, and potentially CWE-640, Weakness in Indirect Reference Management, where the application fails to ensure that indirect references point to appropriate objects with proper access controls. The use of SOAP and REST APIs for these operations indicates a broader architectural issue where API endpoints do not consistently enforce security policies across different communication protocols supported by the platform.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. Users running LogicalDOC Community Edition through version 9.3 should immediately apply any available patches or updates released by the vendor that specifically rectify this authorization flaw in the SoapDocumentService and REST endpoints. In cases where patching is not immediately feasible, administrators can implement network-level controls such as Web Application Firewalls to monitor for anomalous patterns of sequential ID access requests from single IP addresses or user sessions. Additionally, enforcing strict role-based access control policies and auditing logs for unusual document manipulation activities can help detect exploitation attempts in real-time. Long-term resolution requires a comprehensive review of the application's security architecture to ensure that all API endpoints perform rigorous server-side authorization checks against the current session's permissions before executing any state-changing or data-retrieval operations, thereby eliminating reliance on client-side assumptions about resource accessibility.