Live › vulnerability › CVE-2026-113438
Go to dashboardPleasanter fails to verify passwords during LDAP authentication under certain configurations, so a request with only a valid Login ID can be accepted. An attacker can then view, change or delete data with the privileges of that account.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 09:29 UTC. All times on this page are UTC.
Teams running Pleasanter with LDAP authentication enabled under the configuration the advisory describes. Installations that log in with local accounts only, or that do not use LDAP, are not affected by this description. The sources do not list affected or fixed versions.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Pleasanter provided fails to properly verify passwords in LDAP authentication when processing specially crafted requests under certain configurations. If exploited, an attacker may bypass LDAP authentication by providing only a valid Login ID, without a password. As a result, an attacker may view, alter or delete information stored in the product with the privilege of the account used to log in.
This page as .md · .json · in your agent: get_signal("CVE-2026-113438")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.