---
id: "CVE-2026-113438"
kind: "vulnerability"
aliases: ["CVE-2026-113438"]
title: "Pleasanter: LDAP login accepts a valid Login ID without password"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ldap", "package", "pleasanter", "self-hosted"]
not_affected_if: ["ldap-disabled"]
published_at: "2026-10-26T09:16:34+00:00"
first_seen_at: "2026-10-26T09:29:15+00:00"
updated_at: "2026-10-26T09:30:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113438", "first_seen_at": "2026-10-26T09:29:15+00:00"}]
---

# Pleasanter: LDAP login accepts a valid Login ID without password

Pleasanter fails to verify passwords during LDAP authentication under certain configurations, so a request with only a valid Login ID can be accepted. An attacker can then view, change or delete data with the privileges of that account.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-26T09:29:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113438

## From the sources

Pleasanter provided fails to properly verify passwords in LDAP authentication when processing specially crafted requests under certain configurations.  If exploited, an attacker may bypass LDAP authentication by providing only a valid Login ID, without a password. As a result, an attacker may view, alter or delete information stored in the product with the privilege of the account used to log in.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_