Medium severity5.3NVD Advisory· Published Oct 12, 2026
CVE-2026-109206
CVE-2026-109206
Description
LogicalDOC Community Edition through 9.3 contains a username enumeration vulnerability that allows unauthenticated attackers to identify valid accounts because the AvatarServlet (/avatar) performs no session validation. Attackers can supply usernames or numeric IDs in the userId parameter and compare 1x1 transparent images against real avatars to enumerate users and retrieve profile pictures.
Affected products
1- Range: <=9.3
Patches
Vulnerability mechanics
References
3- github.com/logicaldoc/community/blob/9.3/logicaldoc-webapp/src/main/java/com/logicaldoc/web/AvatarServlet.javanvd
- github.com/logicaldoc/community/commit/4e93a69526ae7fe50f670b85b3fc57181f3de3f7nvd
- www.vulncheck.com/advisories/logicaldoc-community-edition-through-9.3-username-enumeration-via-avatarservletnvd
News mentions
0No linked articles in our index yet.