CVE-2026-113438
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Pleasanter fails to properly verify passwords in LDAP authentication when processing specially crafted requests under certain configurations. If exploited, an attacker may bypass LDAP authentication by providing only a valid Login ID, without a password. As a result, an attacker may view, alter or delete information stored in the product with the privilege of the account used to log in.
Risk Assessment
Bypassing LDAP authentication can enable unauthorized access to application data and functions with the privileges of the impersonated account, leading to confidentiality and integrity breaches.
Recommendation
Update Pleasanter to a version containing the fix if available, and verify LDAP authentication configuration while restricting network access to the application.
Other vulnerabilities in Pleasanter
See all- CVE-2025-61931Medium
Pleasanter contains a stored cross-site scripting vulnerability in Body, Description and Comments, which allows an attacker to execute an arbitrary script in a logged-in user's web browser.
- CVE-2025-58070Medium
Pleasanter contains a stored cross-site scripting vulnerability in Preview for Attachments, which allows an attacker to execute an arbitrary script in a logged-in user's web browser.
Original NVD description (English source)
Pleasanter provided fails to properly verify passwords in LDAP authentication when processing specially crafted requests under certain configurations. If exploited, an attacker may bypass LDAP authentication by providing only a valid Login ID, without a password. As a result, an attacker may view, alter or delete information stored in the product with the privilege of the account used to log in.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS