Description

LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in SoapDocumentService operations that allows authenticated users to access and modify unauthorized documents. Attackers can call copy, getExtractedText, deleteVersion, reindex, deleteLink, or restore via SOAP or /services/rest/document with sequential document IDs to disclose, delete, or tamper with documents.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-10-12T14:17:10.680Z",
  "pubdate": "2026-10-12T14:17:10.680Z",
  "executiveSummary": "LogicalDOC Community Edition versions through 9.3 are susceptible to a missing authorization vulnerability within the SoapDocumentService.\nThis flaw resides in the handling of SOAP and RESTful API requests, where the system fails to adequately validate user permissions before executing document management operations.\nAn authenticated user, regardless of their privilege level or assigned access control lists, can interact with documents they are not authorized to view or modify.\nThe vulnerability enables unauthorized actors to perform sensitive operations such as duplicating, deleting, indexing, or altering document links.\nBy manipulating sequential document identifiers (IDs) in requests directed at the /services/rest/document endpoint or via SOAP, an attacker can conduct large-scale information disclosure or system-wide data tampering.\nThis represents a critical failure in the application's access control layer, posing significant risks to data confidentiality, integrity, and availability within the document management ecosystem.",
  "technicalDetails": "The root cause of this vulnerability is improper authorization validation within the SoapDocumentService component of LogicalDOC Community Edition. While the application requires authentication to access these services, it fails to enforce fine-grained access control checks on the back-end logic once the initial session is established.\nThe flaw manifests specifically in operations such as copy, getExtractedText, deleteVersion, reindex, deleteLink, and restore. These functions are exposed via both the SOAP protocol and the /services/rest/document REST API endpoint. Because the application logic relies on client-provided document IDs without validating that the authenticated user maintains ownership or appropriate read/write permissions for the requested resource, it falls victim to an Insecure Direct Object Reference (IDOR) pattern.\nThe exploitation flow is straightforward: an authenticated attacker identifies the predictable or sequential pattern of document IDs used by the LogicalDOC instance. By crafting a request to the vulnerable API endpoints, the attacker passes these identifiers as parameters. The server-side code processes the request and executes the requested operation—such as deleting a version or extracting text content—without checking if the user session is authorized for the specific document ID provided.\nAttackers can leverage this to systematically enumerate documents across the platform. By iterating through IDs, an attacker can extract full-text content from sensitive files, delete critical versions to impede business continuity, or manipulate document metadata and link structures to induce denial-of-service conditions or unauthorized data modification. Because the vulnerability affects both the SOAP interface and the REST services, the attack surface is broad, allowing for automated exploitation via scripting.\nThis vulnerability persists across all versions up to and including 9.3. The lack of an authorization layer at the API gateway or within the controller logic means that any authenticated user—even those with low-privilege 'guest' or 'viewer' accounts—effectively gains administrative-level control over the document repository's contents. Post-exploitation, the impact ranges from unauthorized data exfiltration of internal proprietary documents to complete repository corruption via unauthorized deletion and restoration sequences."
}