{"id":"CVE-2026-113438","published":"2026-10-26T09:16:34.473","lastModified":"2026-10-26T15:16:38.463","description":"Pleasanter provided fails to properly verify passwords in LDAP authentication when processing specially crafted requests under certain configurations.  If exploited, an attacker may bypass LDAP authentication by providing only a valid Login ID, without a password. As a result, an attacker may view, alter or delete information stored in the product with the privilege of the account used to log in.","cvssScore":6.5,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cwes":["CWE-304"],"vendors":[],"products":[],"references":[{"url":"https://jvn.jp/en/jp/JVN82312317/","tags":[]},{"url":"https://pleasanter.org/news/vulnerability-update-20261023/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}