A missing authorization check in the ConvertPdf servlet lets attackers who are already logged in retrieve any PDF file and its historical versions from directories they should not see, simply by supplying sequential document IDs and a version number. This flaw allows information disclosure of confidential documents, which could include sensitive internal records or intellectual property. The weakness is a classic missing enforcement of business‑level authorization controls, making the system exploitable for data theft.

LogicalDOC Community Edition versions 9.0 through 9.3 are affected, as the vulnerability exists in the servlet code shipped with those releases. The issue stems from the ConvertPdf.java class present in the community edition source tree.

The CVSS score of 7.1 indicates a high risk level. Because the exploit requires only an authenticated user and no additional foothold, the attack surface is low; a web request to the ConvertPdf endpoint is sufficient. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog, which suggests it has not yet been widely exploited in the wild. Still, any authenticated user could enumerate document identifiers and download restricted files, making the problem critical for organizations that handle sensitive data.