{"vulnerability": "CVE-2026-109201", "sightings": [{"uuid": "d5266568-7305-4784-b0be-e7c3c50b5b69", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-109201", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117428285645900347", "content": "CVE-2026-109201 LogicalDOC Community Edition through 9.3 Missing Authorization in DocumentService LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in SoapDocumentService operations that allows authenticated users to access and modify unauthorized documents. Attackers can call copy, getExtractedText, deleteVersion, reindex, deleteLink, or restore via SOAP or /services/rest/document with sequential document IDs to disclose, delete, or tamper with documents.\nhttps://www.cve.org/CVERecord?id=CVE-2026-109201https://github.com/logicaldoc/community/discussions/119https://github.com/logicaldoc/community/commit/648047ee0ec95c294bb983e511fed60dbc67977fhttps://github.com/logicaldoc/community/blob/9.3/logicaldoc-webservice/src/main/java/com/logicaldoc/webservice/soap/endpoint/SoapDocumentService.java#L445https://github.com/logicaldoc/communityhttps://www.vulncheck.com/advisories/logicaldoc-community-edition-through-9.3-missing-authorization-in-documentservice#LogicalDOC #LogicalDOCCommunityEdition#CVE_2026_109201#bot", "creation_timestamp": "2026-10-12T13:57:21.187986Z"}]}