{"id":"CVE-2026-109202","published":"2026-10-12T14:17:10.827","lastModified":"2026-10-13T20:41:35.943","description":"LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the zip-export servlet that allows authenticated users to export restricted folders by supplying a folderId parameter. Attackers can request /zip-export with a restricted folder ID, since ZipExport.addFolderDocuments() skips READ and DOWNLOAD permission checks, to download all of its documents in a ZIP archive.","cvssScore":6.5,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://github.com/logicaldoc/community","tags":[]},{"url":"https://github.com/logicaldoc/community/blob/9.3/logicaldoc-core/src/main/java/com/logicaldoc/core/transfer/ZipExport.java#L233","tags":[]},{"url":"https://github.com/logicaldoc/community/blob/9.3/logicaldoc-webapp/src/main/java/com/logicaldoc/web/ExportZip.java#L57","tags":[]},{"url":"https://github.com/logicaldoc/community/commit/648047ee0ec95c294bb983e511fed60dbc67977f","tags":[]},{"url":"https://github.com/logicaldoc/community/discussions/119","tags":[]},{"url":"https://www.vulncheck.com/advisories/logicaldoc-community-edition-through-9.3-missing-authorization-via-zip-export-servlet","tags":[]}],"exploitRefs":[{"url":"https://github.com/logicaldoc/community","tags":[]},{"url":"https://github.com/logicaldoc/community/blob/9.3/logicaldoc-core/src/main/java/com/logicaldoc/core/transfer/ZipExport.java#L233","tags":[]},{"url":"https://github.com/logicaldoc/community/blob/9.3/logicaldoc-webapp/src/main/java/com/logicaldoc/web/ExportZip.java#L57","tags":[]},{"url":"https://github.com/logicaldoc/community/commit/648047ee0ec95c294bb983e511fed60dbc67977f","tags":[]},{"url":"https://github.com/logicaldoc/community/discussions/119","tags":[]}],"hasPoc":true,"ai":null}