CVE-2026-109204 in Community Edition
Summary
by MITRE • 10/12/2026
LogicalDOC Community Edition through 9.3 contains an improper authorization vulnerability in the PswRecovery servlet that fails to bind password recovery tickets to the requesting user. Attackers can obtain a ticket for their own account and reuse it with any userId, including administrators, to reset victims' passwords, lock them out, and reveal their email addresses.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in LogicalDOC Community Edition versions through 9.3 represents a critical failure in access control mechanisms within the password recovery subsystem. Specifically, the PswRecovery servlet exhibits an improper authorization flaw where it does not properly validate that the password reset ticket is associated with the user account requesting the action. This architectural oversight allows for a classic insecure direct object reference scenario, wherein the system trusts client-supplied identifiers without verifying their legitimacy against server-side session data or authentication state. The core technical issue lies in the lack of binding between the generated recovery token and the specific identity context that initiated the request, effectively decoupling the security credential from its intended recipient.
From an operational perspective, this flaw enables attackers to perform unauthorized password resets for any user account within the system. By obtaining a valid reset ticket through legitimate means or exploitation of related flows, an attacker can manipulate the userId parameter in subsequent requests to target arbitrary accounts. This capability extends beyond simple authentication bypass; it allows adversaries to lock out victims by resetting their passwords without knowledge of existing credentials, thereby disrupting business continuity and denying service to specific individuals. Furthermore, the vulnerability facilitates information disclosure as the process may reveal valid email addresses associated with user profiles during the recovery attempt or subsequent interactions, aiding in further reconnaissance efforts such as targeted phishing campaigns.
This type of vulnerability aligns closely with CWE-284 Improper Access Control and CWE-613 Insufficient Session Expiration, although the primary classification is rooted in broken access control principles where the application fails to enforce proper authorization checks for sensitive operations. In terms of threat modeling, this behavior maps directly to MITRE ATT&CK technique T1078 Valid Accounts, specifically involving account manipulation or credential reset abuse. Attackers can leverage this flaw as part of a broader attack chain to gain persistent access to compromised systems, escalate privileges by targeting administrative accounts, and maintain footholds within the network infrastructure without triggering typical authentication failure alerts that might otherwise draw security attention.
Mitigation strategies must prioritize immediate patching to version 9.4 or later where these authorization checks have been corrected. In environments where upgrading is not immediately feasible, administrators should implement strict input validation on server-side requests related to password recovery, ensuring that the user identity embedded in session cookies or tokens matches any userId parameter provided in API calls. Additionally, implementing rate limiting and CAPTCHA challenges for password reset endpoints can mitigate automated exploitation attempts. Security monitoring should be enhanced to detect unusual patterns of password reset activity, such as multiple failed attempts across different accounts from a single source IP address, which may indicate active exploitation of this vulnerability. Regular audits of authentication flows against industry standards like OWASP Authentication Cheat Sheet are recommended to identify and remediate similar logic flaws in other parts of the application.