{"id":"CVE-2026-109204","summary":"LogicalDOC Community Edition through 9.3 Forced Password Reset via Unbound PswRecovery Ticket","details":"LogicalDOC Community Edition through 9.3 contains an improper authorization vulnerability in the PswRecovery servlet that fails to bind password recovery tickets to the requesting user. Attackers can obtain a ticket for their own account and reuse it with any userId, including administrators, to reset victims' passwords, lock them out, and reveal their email addresses.","modified":"2026-10-15T07:08:19.530423699Z","published":"2026-10-12T13:39:45.921Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109204.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-640"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109204.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109204"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/logicaldoc-community-edition-through-9.3-forced-password-reset-via-unbound-pswrecovery-ticket"},{"type":"FIX","url":"https://github.com/logicaldoc/community/commit/afc8554e6654865295bffc8f080c7cb899caf057"},{"type":"PACKAGE","url":"https://github.com/logicaldoc/community"},{"type":"ARTICLE","url":"https://github.com/logicaldoc/community/blob/9.3/logicaldoc-webapp/src/main/java/com/logicaldoc/web/PswRecovery.java#L101"},{"type":"ARTICLE","url":"https://github.com/logicaldoc/community/discussions/119"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/logicaldoc/community","events":[{"introduced":"0"},{"fixed":"ab9fa93090869e6f3a77f2e9b0704e5381ae56ff"},{"fixed":"afc8554e6654865295bffc8f080c7cb899caf057"}],"database_specific":{"source":["DESCRIPTION","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"9.3"}]}}],"versions":["9.2.3","9.2.2","9.2.1","9.2","before-jakarta-porting","9.1.1","9.1","9.0","8.9.3","8.9.2","8.9.1","8.9","8.8.5","8.8.4","8.8.2","8.7.3","8.6.1","8.5.2","8.4.2","v8.0","8.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109204.json","vanir_signatures":[{"source":"https://github.com/logicaldoc/community/commit/afc8554e6654865295bffc8f080c7cb899caf057","target":{"file":"logicaldoc-webapp/src/main/java/com/logicaldoc/web/PswRecovery.java","function":"doGet"},"deprecated":false,"digest":{"length":1157,"function_hash":"335563076297196783966924619945193289194"},"id":"CVE-2026-109204-659382e1","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/logicaldoc/community/commit/afc8554e6654865295bffc8f080c7cb899caf057","target":{"file":"logicaldoc-webapp/src/main/java/com/logicaldoc/web/PswRecovery.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["121128812081348509230410502163896063422","267218126901980950776704350534601197760","105553900274157450172837458138324901814","128625252646328612072678876175676171602","92881654515717335438840622853934541316","225053353085114077132676180002104363093","262039273838027555949129147664442383842","211085656393551014150534951466648257270","258979983222841364953801898424459513319","154225245362473375336013645627425730049","281576302040794350528464817573099406808","108663158515853678572322922825346145983","276533400664432451970355645056702415059","72739108412786042005477077296400247864","23600309065541085890834067438053992364","234639727078523002866848731091930484112","17614191543102225285047673081572961521","146575943269087815276306393096743650935","228539033925053323949625483108409858568","246978252020705380787994461371312702330","13441451550664831960559364591227469600","187240210458855690391078906748556941490","175682142670339589750437437951638223004","336692156453949403073744474141620134108","210307271555673727637758053162369927323","88635670777751605818601311325516916899","71219478323726143168762864678030173980","162474785655916691218161850223647108355","56947500289250621211053222055498482905","336236890626991605305097063919053899557","67738827045752026065008968943413910551","68470018897415925384141225457231495412","25859914140219598810759879645355667559","208147038476295476672398291478023444971","55218130111306846312823661866180941630","197461651447892168176090948564051266216","159367579416691337550348000379306296609","232275992614848583567193555670829426465","323221769303827721393671954126638548599","232993814534408223026480633715745068717","244160371717433477290618476887470587564","289538709998516266683397844208330673068","141453943494852323893266149516692782209","237440478833184951727062137953723858348","252667460436856942349477639586329155028","338794419602235326509638659308621416031","20494014275767951533533164870741628850","69673807422067603645283369120101790974","28531105905542419747655923677799133427","173967346736479762801262302542427508237","168856129282455644326684983820633784159","48537820931953091539281766986361980233","96364522772796531691893558263157074400","197821761981149845701081308385830084128","218263464453536009573027825822888574947","146351062203515336512166295033714405180","68007569557487955651763569719717626008","25057188622429405884394453720459802922","5530599763650460318273633712326480756","236839563010302479691346796931027517789","238100169231511737147102171926164590810","329287422824868651609768925618318390298","124318274706592802575802851397929775353","105030727501341803721536892930080261136","118485816574337419849210549631272796065","279159599036376413564080455786432279992","227407521682320354824637734196299955156","17552795812199764867230590898288356529","67272862537040417644729836157535450845","50561094986346202560252898436850924120","307711428808291691695537258130992422832","209884272924479621052589038801796662001","78471160093247583024975956915076520374","183425524955629650096979172607556679391","63266949835570390537524622668266849439","220081287003859121878628345923621346573","282024083960414413200669974910387065828","8465464402839462470323069491515875310","42270260281593799095372454217702150211","19820210743902246816066244485709249744","212746449397424989645321257074551600933","179525025740954997060089833934340408601","236679484896857262247927735751024876199","330649086067062106561238452142690800620","313473671162264374074786214885589736913","130164676933906790463554596939666043921","219292316616354967829125989127217147690","239608003336674343097977257256894905660","217878334454024586552802118907132680820","140483234424391214882023797070756063663","109956564615527527453129503075586704006","33306393561682652205615619937702549487","201914342702995007858854611903428601900","14598387736708878279855442565870728370","324255426665016161509154624614690704258","245437556025720912449379592721825795784","243222791579427193601022921781157826550","310670550959888885248444188028638199984","25783393562616402047019413592648454237","234030249806811054426440358284548625012","284060652573674280637689094007525960538","327647615433370081765716594089949572925"]},"id":"CVE-2026-109204-f23690c8"}],"vanir_signatures_modified":"2026-10-15T07:08:19Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"}]}