---
id: CVE-2026-109204
title: >-
  LogicalDOC Community Edition through 9.3 contains an improper authorization
  vulnerability in the PswRecovery servlet that fails to bind password recovery
  tickets to the requesting user
summary: >-
  LogicalDOC Community Edition through 9.3 contains an improper authorization
  vulnerability in the PswRecovery servlet that fails to bind password recovery
  tickets to the requesting user. Attackers can obtain a ticket for their own
  account…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'
cwe:
  - CWE-640
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T14:17:11.123'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109204'
references:
  - url: 'https://github.com/logicaldoc/community'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/logicaldoc/community/blob/9.3/logicaldoc-webapp/src/main/java/com/logicaldoc/web/PswRecovery.java#L101
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/logicaldoc/community/commit/afc8554e6654865295bffc8f080c7cb899caf057
    label: disclosure@vulncheck.com
  - url: 'https://github.com/logicaldoc/community/discussions/119'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/logicaldoc-community-edition-through-9.3-forced-password-reset-via-unbound-pswrecovery-ticket
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-12T14:50:34.120Z'
---

## Overview

LogicalDOC Community Edition through 9.3 contains an improper authorization vulnerability in the PswRecovery servlet that fails to bind password recovery tickets to the requesting user. Attackers can obtain a ticket for their own account and reuse it with any userId, including administrators, to reset victims' passwords, lock them out, and reveal their email addresses.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.