LogicalDOC Community Edition versions up to 9.3 contain an improper authorization flaw in the PswRecovery servlet that does not bind password‑recovery tickets to the requesting user. When an attacker obtains a recovery ticket for their own account, they can reuse that ticket with any target userId, including administrators, to reset the victim’s password, lock the account out, and reveal the victim’s email address. This weakness permits an attacker to effectively take over any user account without needing valid credentials for that account.

The vulnerability affects LogicalDOC Community Edition releases through version 9.3. No earlier versions are referenced, and the fix appears to be applied in later releases. Administrators of any installation of this edition should verify the installed version and assess whether the PswRecovery functionality is enabled.

The CVSS score is 5.3, indicating moderate severity, and the EPSS score is not available, suggesting that no widespread exploitation has been observed to date. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote via the web interface: an attacker registers or authenticates with a valid user account to request a password‑recovery ticket, then replays that ticket by manipulating the userId parameter. Because the flaw allows credential reset for arbitrary accounts, the impact ranges from account lockout to full administrator takeover, depending on the target account type.