CVE-2026-109170

MediumCVSS 6.5/10Last modified Oct 13, 2026

Description

LogicalDOC Community Edition through 9.3 contains an HQL injection vulnerability in DocumentsDataServlet that allows authenticated users to manipulate queries via the unvalidated indexed parameter. Attackers with read access to any folder can inject boolean HQL expressions to bypass folder scope and read-permission checks, listing restricted document metadata and extracting database contents.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

VendorProductVersions
LogicalDOCLogicalDOC Community Edition<= 9.3

References

Timeline

Published
Oct 12, 2026
Last modified
Oct 13, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1091714.3yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject cCVE-2026-1091724.3yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject rCVE-2026-1091734.3yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject iCVE-2026-1091746.5MoguBlog through 6.2 contains an information disclosure vulnerability that allows low-privileged front-end users to read system credentials CVE-2026-1091754.3MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to list other adminCVE-2026-1091765.4MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to delete other admCVE-2026-1091774.3MoguBlog through 6.2 contains a broken access control vulnerability that allows authenticated administrators to move or rename other adminisCVE-2026-1091785.4jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to forge, modify, or dCVE-2026-1091794.3jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to read the tenant's oCVE-2026-109188.3Use after free in Viz in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentiaCVE-2026-1091804.3jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to read data from unassigned warehouses byCVE-2026-1091814.3jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users restricted to personal or department data
CVE-2026-109170: Medium severity, CVSS 6.5 | Vulnix