---
id: CVE-2026-109203
title: >-
  LogicalDOC Community Edition through 9.3 contains a missing authorization
  vulnerability in the ConvertPdf servlet that allows authenticated users to
  download restricted PDF documents
summary: >-
  LogicalDOC Community Edition through 9.3 contains a missing authorization
  vulnerability in the ConvertPdf servlet that allows authenticated users to
  download restricted PDF documents. Attackers can enumerate sequential docId
  values and u…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-862
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T14:17:10.977'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109203'
references:
  - url: 'https://github.com/logicaldoc/community'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/logicaldoc/community/blob/9.3/logicaldoc-webapp/src/main/java/com/logicaldoc/web/ConvertPdf.java#L58
    label: disclosure@vulncheck.com
  - url: 'https://github.com/logicaldoc/community/discussions/119'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/logicaldoc-community-edition-through-9.3-missing-authorization-via-convertpdf-servlet
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-12T14:50:34.120Z'
---

## Overview

LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the ConvertPdf servlet that allows authenticated users to download restricted PDF documents. Attackers can enumerate sequential docId values and use the version parameter to retrieve any PDF and its versions from folders they cannot access.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.