CVE-2026-109202 in Community Edition
Summary
by MITRE • 10/12/2026
LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the zip-export servlet that allows authenticated users to export restricted folders by supplying a folderId parameter. Attackers can request /zip-export with a restricted folder ID, since ZipExport.addFolderDocuments() skips READ and DOWNLOAD permission checks, to download all of its documents in a ZIP archive.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified within LogicalDOC Community Edition versions up through 9.3 represents a critical failure in access control mechanisms, specifically categorized under CWE-285 Improper Authorization. This flaw resides within the zip-export servlet functionality, which is designed to allow users to package and download multiple documents from specific folders into a single ZIP archive for offline viewing or backup purposes. The core technical deficiency lies in the implementation of the ZipExport.addFolderDocuments method, which processes requests to export folder contents but fails to validate whether the requesting authenticated user possesses the necessary READ and DOWNLOAD permissions for the target resource. This oversight creates a direct path for unauthorized data exfiltration by bypassing standard security boundaries that should restrict access based on user roles and assigned privileges.
From an operational perspective, this vulnerability allows any authenticated user, regardless of their privilege level or role within the system, to specify arbitrary folder identifiers in the request parameters. By supplying a folderId corresponding to restricted areas such as administrative directories, confidential project folders, or sensitive client data repositories, an attacker can trigger the export mechanism without triggering permission errors. The server processes this request by aggregating all documents contained within the specified folder into a compressed archive and delivering it to the requester. This behavior effectively neutralizes the intended security controls that rely on granular access policies, rendering them ineffective against internal threats or compromised accounts with minimal privileges.
The impact of this vulnerability is significant in terms of data confidentiality and integrity. Attackers can systematically enumerate valid folder IDs by attempting sequential values or leveraging known structural patterns within the application to discover restricted resources. Once a target folder is identified, the attacker can download its entire contents, potentially exposing proprietary information, personal identifiable data, or other sensitive materials that were intended to be kept private from certain user groups. This capability aligns with ATT&CK technique T1005 Data from Local System Retrieval, as it involves an adversary collecting and exfiltrating data directly from the application server's storage via a legitimate but misconfigured interface. The ease of exploitation means that even users with basic access rights can escalate their effective privileges to read any content within the system simply by manipulating input parameters.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. For organizations currently running affected versions, upgrading to a patched version of LogicalDOC Community Edition is the primary recommendation, as vendors typically resolve such authorization flaws in subsequent releases. In cases where an upgrade is not immediately feasible, administrators should implement web application firewall rules that monitor for suspicious patterns in zip-export requests, particularly those involving unusual folder ID structures or high-volume export attempts. Additionally, a thorough code review focusing on all endpoints handling resource access is necessary to ensure that permission checks are consistently applied before any data processing occurs. Developers must enforce the principle of least privilege by validating user permissions against the specific resources being accessed at every step of the request lifecycle, ensuring that no method bypasses standard authorization logic. Regular security audits and penetration testing should also be conducted to identify similar gaps in other modules where access control might be inconsistently enforced.