Is CVE-2026-109206 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-109206?

CVE-2026-109206 has a CVSS v3 severity of MEDIUM (5.3).

Back

CVE-2026-109206

Description

LogicalDOC Community Edition through 9.3 contains a username enumeration vulnerability that allows unauthenticated attackers to identify valid accounts because the AvatarServlet (/avatar) performs no session validation. Attackers can supply usernames or numeric IDs in the userId parameter and compare 1x1 transparent images against real avatars to enumerate users and retrieve profile pictures.