CVE-2026-109203: Missing Authorization in LogicalDOC LogicalDOC Community Edition

CVE-2026-109203 is a missing authorization vulnerability in LogicalDOC Community Edition through version 9.3. The issue exists in the ConvertPdf servlet, which does not properly enforce access controls. Authenticated users can exploit this flaw by enumerating sequential docId values and manipulating the version parameter to download any PDF document and its versions, including those stored in folders they do not have permission to access. This allows unauthorized disclosure of restricted documents.

The vulnerability enables authenticated users to bypass authorization controls and download restricted PDF documents from unauthorized folders. This leads to unauthorized disclosure of sensitive information contained in those PDFs. There is no indication of privilege escalation or remote code execution, but the confidentiality of documents is compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the LogicalDOC Community Edition to trusted users only and monitor for suspicious activity related to document downloads. Avoid exposing the ConvertPdf servlet to untrusted users.