LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the zip-export servlet that allows authenticated users to export restricted folders by supplying a folderId parameter. Attackers can request /zip-export with a restricted folder ID, since ZipExport.addFolderDocuments() skips READ and DOWNLOAD permission checks, to download all of its documents in a ZIP archive. This results in unauthorized disclosure of potentially sensitive documents. The weakness is a missing authorization check (CWE-862).

LogicalDOC Community Edition, versions up to and including 9.3, are affected. The vulnerability occurs in the ZipExport servlet located in the community edition codebase. No other vendor products are indicated.

The CVSS score of 7.1 indicates high impact, and the EPSS score is not available, suggesting no known exploitation data at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. Attackers need to be authenticated to use the zip-export endpoint; the likely attack vector is via the application's web interface or API over a network connection. An attacker who knows or can discover a restricted folderId can trigger the endpoint to retrieve all documents in that folder, thereby breaching confidentiality for authorized users.