Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-109204: LogicalDOC Community Edition lets password reset be hijacked

CVE-2026-109204 · published 23 days ago

Summary

LogicalDOC Community Edition (versions up to 9.3) allows anyone who can obtain a password‑recovery ticket to use it to change any user's password, including administrators. This can lock users out of their accounts and expose their email addresses. Apply the vendor's security update or disable the password‑recovery feature until the patch is installed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
logicaldoc	logicaldoc community edition	<= 9.3

Original advisory text

LogicalDOC Community Edition through 9.3 Forced Password Reset via Unbound PswRecovery Ticket

LogicalDOC Community Edition through 9.3 contains an improper authorization vulnerability in the PswRecovery servlet that fails to bind password recovery tickets to the requesting user. Attackers can obtain a ticket for their own account and reuse it with any userId, including administrators, to reset victims' passwords, lock them out, and reveal their email addresses.

References

https://github.com/logicaldoc/community Product
https://github.com/logicaldoc/community/commit/afc8554e6654865295bffc8f080c7cb89... Patch
https://github.com/logicaldoc/community/blob/9.3/logicaldoc-webapp/src/main/java... Third Party Advisory
https://www.vulncheck.com/advisories/logicaldoc-community-edition-through-9.3-fo... Vendor Advisory
https://github.com/logicaldoc/community/discussions/119 Third Party Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-1092... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-109204 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

7.9 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-640Weak Password Recovery Mechanism for Forgotten Password

Timeline

Published12 Oct 2026

Updated29 Oct 2026

First seen12 Oct 2026

Sources

CVE-2026-109204 · NVD

CVE-2026-109204 · MITRE

CVE-2026-109204 · OSV

Track software like this

Free during beta