LDAP Authentication Bypass in Pleasanter by Pleasanter
CVE-2026-113438

6.9MEDIUM

Key Information:

Vendor

Implem Inc.

Status
Pleasanter
Vendor
CVE Published:
26 October 2026

What is CVE-2026-113438?

Pleasanter suffers from a vulnerability in its LDAP authentication mechanism, which inadequately verifies passwords under specific configurations. Attackers exploiting this flaw can bypass authentication checks by providing only a valid Login ID, granting them unauthorized access to view, alter, or delete information stored within the application. This issue emphasizes the importance of robust authentication practices to safeguard sensitive user data.

Affected Version(s)

Pleasanter 1.1.0.0 <= 1.5.9.0

References

https://pleasanter.org/news/vulnerability-update-20261023/
https://jvn.jp/en/jp/JVN82312317/

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

CVSS V3.0

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.