The vulnerability resides in the AvatarServlet of LogicalDOC Community Edition through version 9.3. Attackers can send HTTP requests to the /avatar endpoint with a userId parameter containing either a username or numeric ID. The servlet returns a 1×1 transparent image when no real avatar exists, and a real avatar image when the account is valid. By comparing the returned images, an unauthenticated attacker can identify which user identifiers are valid and obtain profile pictures. This reveals user identities and personal photos, compromising confidentiality.

LogicalDOC Community Edition, versions up to and including 9.3, delivered through the community edition package. The vulnerable component is the AvatarServlet accessed via the /avatar URL.

The CVSS score of 6.9 indicates a moderate severity. The EPSS score is not available, and CISA has not listed this vulnerability in its KEV catalog. The exploit requires no authentication, only HTTP requests to a publicly reachable endpoint, making it easily reachable by external attackers. Because the servlet does not perform session validation, enumeration can proceed from any network location. The primary risk is the disclosure of user identities and profile pictures, which may lead to social engineering or privacy violations. Mitigating this vulnerability removes the ability to discover valid usernames through visual comparison.