LogicalDOC Community Edition versions up to 9.3 contain a missing authorization flaw in the SoapDocumentService that lets any authenticated user invoke protected operations—copy, getExtractedText, deleteVersion, reindex, deleteLink, or restore—without regard to document ownership. An attacker can enumerate sequential document identifiers through SOAP or the /services/rest/document endpoint and thereby disclose, delete, or tamper with documents belonging to other users. This flaw is classified as CWE‑862 (Access Control Failure).

The vulnerability affects LogicalDOC Community Edition through version 9.3. No specific revisions beyond 9.3 are listed; therefore any deployment of the community edition up to that release is at risk.

The CVSS score of 8.7 marks this issue as high‑severity, and although no EPSS value is available, the lack of a KEV listing suggests that it has not yet been widely exploited in the wild. The flaw is exploitable over the network by any authenticated user who can craft SOAP or REST calls. Once an attacker obtains valid credentials, they can enumerate document IDs and achieve unauthorized disclosure or modification, jeopardizing confidentiality and integrity of stored data.