CVE-2026-109206

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-109206
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109206.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-109206
Published
2026-10-12T13:39:47Z
Modified
2026-10-28T11:06:19Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
LogicalDOC Community Edition through 9.3 Username Enumeration via AvatarServlet
Details

LogicalDOC Community Edition through 9.3 contains a username enumeration vulnerability that allows unauthenticated attackers to identify valid accounts because the AvatarServlet (/avatar) performs no session validation. Attackers can supply usernames or numeric IDs in the userId parameter and compare 1x1 transparent images against real avatars to enumerate users and retrieve profile pictures.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-204"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109206.json"
}
References

Affected packages

Git / github.com/logicaldoc/community

Affected ranges

Type
GIT
Repo
https://github.com/logicaldoc/community
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
4e93a69526ae7fe50f670b85b3fc57181f3de3f7
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "last_affected": "9.3"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "4e93a69526ae7fe50f670b85b3fc57181f3de3f7"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

8.*
8.0
8.4.2
8.5.2
8.6.1
8.7.3
8.8.2
8.8.4
8.8.5
8.9
8.9.1
8.9.2
8.9.3
9.*
9.0
9.1
9.1.1
9.2
9.2.1
9.2.2
9.2.3
9.3
Other
before-jakarta-porting
v8.*
v8.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109206.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "295431724303997464559898708035914395835",
                "257990186633970055942552925896333853873",
                "215070028193629983792013762753283280355",
                "218107440040276615904209992764279772380",
                "206924368854838771966265641623329675171",
                "317229987784927702635395296956041217028",
                "1065759449079557068033099522580563905",
                "134229180216994375773464916166654829915",
                "243058888242497197487504010445062106374",
                "179382551453075464277247368008066675579",
                "1498232893402956166466475816723792806",
                "211085656393551014150534951466648257270",
                "258979983222841364953801898424459513319",
                "298551596521379284188681462918888590560",
                "124441481250675242418070243115872812045",
                "315856909326256206300098255333157626650",
                "79680674316632789187367181947463841391",
                "248487166078953429728345727838905775550",
                "289522885243558253135242413292764451975",
                "130617775424120785839281775040059258733",
                "152309869195253629201654831193267179462",
                "189367039649427491747800339330244520388",
                "283109367344748392981666521910541187816",
                "102248700692497219136542665242215941554",
                "203429029022029930449477843257878453437",
                "328052967195884442055615941109127864357",
                "231439272270214675237679689645624655989",
                "331843775506505074394502620729562693816",
                "236204053496492428997057881885306460908",
                "296501535207836702896224897110091697949",
                "272712875104581385865816206716247690945",
                "184923496909007390995073235718189368767",
                "28469504389470423110629353004874461066",
                "179024928127393039724301959119020322345",
                "191292488737609295533640174701916431513",
                "218549175432792650282453939192147616806",
                "260598884367747507965087043547982992832",
                "165349730976688490753168688792402884659",
                "216221020160484857890145707912244598960",
                "230738963506260967982893033067847916715",
                "135598921725814151955152388340779907985",
                "268583311848848047395163094422881996421",
                "59139280701165723436846344640286312200",
                "242012549215040334292506041803411587880",
                "266919570138356416379997315561239387430",
                "100514374500750718508466294643223504987",
                "2667085771931763558574787792334306261",
                "299751350724256336221213574134228635191"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-109206-0a8f8390",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/logicaldoc/community/commit/4e93a69526ae7fe50f670b85b3fc57181f3de3f7",
        "target": {
            "file": "logicaldoc-webapp/src/main/java/com/logicaldoc/web/AvatarServlet.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "272450181826681409485140818772715980694",
                "208021198608603895046950817396750570030",
                "120166259367781757910516761793013232293",
                "335599266942285992694595586444378957339"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-109206-b088d2da",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/logicaldoc/community/commit/4e93a69526ae7fe50f670b85b3fc57181f3de3f7",
        "target": {
            "file": "logicaldoc-core/src/main/java/com/logicaldoc/core/util/UserUtil.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "46051232781004844862154331802850791813",
            "length": 685
        },
        "id": "CVE-2026-109206-db5c7e9e",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/logicaldoc/community/commit/4e93a69526ae7fe50f670b85b3fc57181f3de3f7",
        "target": {
            "file": "logicaldoc-webapp/src/main/java/com/logicaldoc/web/AvatarServlet.java",
            "function": "doGet"
        }
    }
]
vanir_signatures_modified 
"2026-10-28T11:06:19Z"