CVE-2026-109206 [MEDIUM] – LogicalDOC Community Edition through 9.3 contains a username enumeration vulnerability tha

LogicalDOC Community Edition through 9.3 contains a username enumeration vulnerability that allows unauthenticated attackers to identify valid accounts because the AvatarServlet (/avatar) performs no session validation. Attackers can supply usernames or numeric IDs in the userId parameter and compare 1×1 transparent images against real avatars to enumerate users and retrieve profile pictures.