Is CVE-2026-109201 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-109201?

CVE-2026-109201 has a CVSS v3 severity of HIGH (8.3).

Back

CVE-2026-109201

Description

LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in SoapDocumentService operations that allows authenticated users to access and modify unauthorized documents. Attackers can call copy, getExtractedText, deleteVersion, reindex, deleteLink, or restore via SOAP or /services/rest/document with sequential document IDs to disclose, delete, or tamper with documents.