TI-2026-70991 Aliases CVE-2026-109206 GHSA-g7j6-49p3-h792

Username enumeration in LogicalDOC Community Edition via AvatarServlet

LOW 30CWE-204Published 2026-10-12 · Updated 2026-10-13

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-204.

Summary

LogicalDOC Community Edition through 9.3 contains a username enumeration flaw in the AvatarServlet at /avatar, which performs no session validation. The servlet returns an observable response difference (CWE-204) that reveals whether an account exists. An unauthenticated remote attacker can submit usernames or numeric IDs in the userId parameter and compare the returned images to enumerate valid users and retrieve their profile pictures.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

LogicalDOC Community Edition through 9.3 contains a username enumeration vulnerability that allows unauthenticated attackers to identify valid accounts because the AvatarServlet (/avatar) performs no session validation. Attackers can supply usernames or numeric IDs in the userId parameter and compare 1x1 transparent images against real avatars to enumerate users and retrieve profile pictures.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00248 16th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
LogicalDOC	LogicalDOC Community Edition	up to 9.3	—	No fix listed	CNA

LogicalDOC Community Edition VendorLogicalDOC Affected up to 9.3 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for LogicalDOC Community Edition.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

2026-10-12 Threatist record created from CVE-2026-109206
2026-10-12 Alias added: GHSA-g7j6-49p3-h792
2026-10-13 CISA SSVC decision points changed
2026-10-13 Priority changed: MEDIUM → LOW

References

Patch 1

Patch Commit

Other 3

TI-2019-15311 LogicalDOC Enterprise 7.7.4 Authenticated Command Execution via Binary Path Manipulation CVSS 4.0HIGH 8.7
TI-2019-15312 LogicalDOC Enterprise 7.7.4 Multiple Post-Authentication Directory Traversal Vulnerabilities CVSS 4.0HIGH 7.1
TI-2025-11510 LogicalDOC Community Edition Admin Login login.jsp excessive authentication CVSS 4.0MEDIUM 6.3
TI-2022-23495 LogicalDOC Document Version Comment Stored XSS CVSS 3.1MEDIUM 5.4
TI-2022-23494 LogicalDOC Document File Name Stored XSS CVSS 3.1MEDIUM 5.4
TI-2022-23493 LogicalDOC Chat Stored XSS CVSS 3.1MEDIUM 5.4

See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences