Is CVE-2026-109206 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109206 being exploited in the wild.

How severe is CVE-2026-109206?

Medium severity, with a CVSS score of 5.3, published 12 October 2026.

Which products and versions are affected?

LogicalDOC Community Edition through 9.3.

Is there a fix for CVE-2026-109206?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-109206 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-109206?

Check whether you run LogicalDOC Community Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109206: LogicalDOC Community Edition username enumeration in AvatarServlet

CVE-2026-109206 · Severity: medium · CVSS 5.3 · Published 2026-10-12

LogicalDOC Community Edition is an open-source document management system. An attacker can discover valid usernames and retrieve profile pictures by querying the avatar endpoint without authentication, comparing responses to identify real accounts versus placeholder images. This enables targeted attacks and information gathering about system users.

Technologies: LogicalDOC Community Edition. Vendors: LogicalDOC.

Quick answers

Is CVE-2026-109206 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109206 being exploited in the wild.
How severe is CVE-2026-109206?: Medium severity, with a CVSS score of 5.3, published 12 October 2026.
Which products and versions are affected?: LogicalDOC Community Edition through 9.3.
Is there a fix for CVE-2026-109206?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-109206 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-109206?: Check whether you run LogicalDOC Community Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The AvatarServlet (/avatar) endpoint performs no session validation on the userId parameter, allowing unauthenticated access to user avatar images. Attackers can supply usernames or numeric IDs and differentiate between valid users (who have real avatars or auto-generated ones) and invalid users (who receive only placeholder images), enabling user enumeration. The vulnerable code path calls UserDAO.findById() directly without authentication checks.

Affected products

LogicalDOC Community Edition through 9.3

Timeline

2026-10-12: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.