CVE-2026-109206: Observable Response Discrepancy in LogicalDOC LogicalDOC Community Edition

CVE-2026-109206 describes a username enumeration vulnerability in LogicalDOC Community Edition through version 9.3. The vulnerability exists because the AvatarServlet (/avatar) endpoint lacks session validation, permitting unauthenticated attackers to supply usernames or numeric IDs in the userId parameter. By comparing the returned 1x1 transparent images against actual avatars, attackers can enumerate valid user accounts and access profile pictures. The CVSS 4.0 score is 6.9, indicating a medium severity vulnerability with network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality.

An unauthenticated attacker can enumerate valid usernames and retrieve profile pictures from the LogicalDOC Community Edition system. This information disclosure can aid further targeted attacks such as phishing or brute force attempts. However, the vulnerability does not allow direct system compromise or privilege escalation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the AvatarServlet endpoint if possible or monitor for suspicious requests targeting this endpoint. Avoid exposing this endpoint publicly to reduce risk.