Description

LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the ConvertPdf servlet that allows authenticated users to download restricted PDF documents. Attackers can enumerate sequential docId values and use the version parameter to retrieve any PDF and its versions from folders they cannot access.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-10-12T14:17:10.977Z",
  "pubdate": "2026-10-12T14:17:10.977Z",
  "executiveSummary": "LogicalDOC Community Edition versions through 9.3 are susceptible to a missing authorization vulnerability within the ConvertPdf servlet.\nThis flaw enables authenticated users to bypass mandatory access control restrictions, facilitating unauthorized retrieval of sensitive PDF documents and their respective version histories.\nThe vulnerability stems from improper input validation and the absence of authorization checks when processing document retrieval requests.\nBy manipulating sequential identifiers, an attacker can perform enumeration attacks to access files stored within folders for which they lack legitimate permissions.\nThe impact is significant, leading to potential data exposure and unauthorized information disclosure of confidential intellectual property or administrative documents.\nExploitation requires an existing authenticated session, though it does not necessitate administrative privileges, allowing standard users to escalate their data access scope significantly beyond their intended authorization level.",
  "technicalDetails": "The vulnerability resides in the ConvertPdf servlet, which is responsible for handling PDF conversion and retrieval requests within the LogicalDOC architecture.\nThe root cause is a failure to perform server-side authorization validation before processing a file download request. When a request is submitted to this servlet, the application fails to verify whether the authenticated user possesses the required permissions for the specific document requested.\nThe attack vector relies on the predictable nature of the docId parameter. The application processes requests using sequential numeric identifiers for document storage. An attacker can systematically iterate through these integers to identify and download documents they are not authorized to access.\nAdditionally, the version parameter allows the attacker to specify and retrieve specific historical iterations of a document. This combination allows for comprehensive enumeration and extraction of document repositories.\nAttack Flow: 1. The attacker establishes an authenticated session on the LogicalDOC instance. 2. The attacker identifies the ConvertPdf endpoint. 3. The attacker crafts an HTTP request targeting the servlet, supplying a guessable docId and a specific version number. 4. The server receives the request and, lacking a granular permission check for the object identified by the docId, serves the requested file content directly to the attacker.\nThe vulnerable component is the ConvertPdf servlet's request handling logic, which prioritizes function execution over security context verification. This issue affects LogicalDOC Community Edition versions through 9.3.\nThe exposure is accessible over the network to any user with valid platform credentials. Post-exploitation impact includes the full compromise of document confidentiality, where attackers can exfiltrate sensitive documentation, bypass folder-level security restrictions, and reconstruct document timelines through version history enumeration."
}