CVE-2026-109204

LogicalDOC Community Edition through version 9.3 is vulnerable to an improper authorization flaw in the PswRecovery servlet . The root cause is the failure to bind password recovery tickets to the specific requesting user. This allows an attacker to obtain a ticket for their own account and reuse...