Is CVE-2026-109204 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-109204?

CVE-2026-109204 has a CVSS v3 severity of MEDIUM (6.3).

Back

CVE-2026-109204

Description

LogicalDOC Community Edition through 9.3 contains an improper authorization vulnerability in the PswRecovery servlet that fails to bind password recovery tickets to the requesting user. Attackers can obtain a ticket for their own account and reuse it with any userId, including administrators, to reset victims' passwords, lock them out, and reveal their email addresses.