CVE-2026-109204: Weak Password Recovery Mechanism for Forgotten Password in LogicalDOC LogicalDOC Community Edition

CVE-2026-109204 describes an improper authorization vulnerability in LogicalDOC Community Edition through version 9.3. The vulnerability exists in the PswRecovery servlet, which fails to bind password recovery tickets to the user who requested them. An attacker can obtain a password recovery ticket for their own account and reuse it with any userId, including those of administrators. This allows the attacker to reset victims' passwords, lock them out of their accounts, and reveal their email addresses. The CVSS 4.0 base score is 5.3, indicating a medium severity vulnerability with network attack vector, low complexity, no privileges required, and no user interaction needed.

Successful exploitation allows an attacker with limited privileges to reset passwords of arbitrary users, including administrators. This can lead to denial of access for legitimate users and disclosure of email addresses associated with those accounts. The vulnerability compromises account integrity and confidentiality within affected LogicalDOC Community Edition installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the password recovery functionality and monitor for suspicious password reset activities. Avoid using affected versions in sensitive environments.