Description

LogicalDOC Community Edition through 9.3 contains a username enumeration vulnerability that allows unauthenticated attackers to identify valid accounts because the AvatarServlet (/avatar) performs no session validation. Attackers can supply usernames or numeric IDs in the userId parameter and compare 1x1 transparent images against real avatars to enumerate users and retrieve profile pictures.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-10-12T14:17:11.427Z",
  "pubdate": "2026-10-12T14:17:11.427Z",
  "executiveSummary": "LogicalDOC Community Edition through version 9.3 is susceptible to a username enumeration vulnerability via the AvatarServlet endpoint.\nThe vulnerability originates from a lack of session validation within the /avatar servlet, allowing unauthenticated attackers to confirm the existence of valid user accounts.\nBy manipulating the 'userId' parameter, an attacker can programmatically probe the system to determine if a specific user identifier corresponds to a registered account.\nSuccessful exploitation results in the exposure of valid usernames and access to associated profile pictures, which facilitates targeted reconnaissance for subsequent attacks such as credential stuffing or social engineering.\nThe vulnerability is remotely exploitable without authentication, posing a significant risk to user privacy and information security. The primary impact is the unauthorized disclosure of account existence and metadata.\nNo specific privileges are required to initiate this attack, making it accessible to any unauthenticated actor with network access to the target instance.",
  "technicalDetails": "The vulnerability resides in the AvatarServlet component, mapped to the /avatar endpoint, which is designed to retrieve profile avatars for system users.\nThe root cause is a deficiency in input validation and session enforcement logic; the servlet fails to verify the authentication status of the requester before processing the 'userId' parameter.\nExploitation is achieved by sending HTTP GET requests to the /avatar URI while injecting various usernames or numeric IDs into the 'userId' parameter. The server responds differently based on the validity of the provided ID.\nSpecifically, the application serves a 1x1 transparent image if the requested user exists. By analyzing the response content or header metadata, an attacker can distinguish between existing accounts and non-existent identifiers.\nThe attack flow follows a sequential enumeration pattern: 1) The attacker constructs a list of potential usernames or sequences of numeric IDs. 2) For each entry, the attacker sends a crafted request to the /avatar servlet. 3) The application processes the request server-side, attempting to locate the user profile associated with the input. 4) If the user is identified, the server retrieves the profile image and returns the resource; if the user is not found, the server typically returns an error or a default image.\nBy comparing the server's response signatures—such as response size, HTTP status codes, or image content hashes—the attacker effectively confirms account existence. This mechanism bypasses the intended access control measures, as the servlet does not restrict access to these resources to authorized sessions only.\nThis behavior exposes the underlying user directory, allowing for the systematic collection of valid account names. Such information is highly valuable for threat actors conducting password spraying or targeted phishing campaigns, as it allows them to prune their target lists to only include confirmed valid identities, thereby increasing the efficiency and stealth of follow-up exploitation attempts.\nThe vulnerability affects all iterations of LogicalDOC Community Edition up to and including version 9.3."
}