---
id: CVE-2026-113438
title: >-
  Pleasanter provided fails to properly verify passwords in LDAP authentication
  when processing specially crafted requests under certain configurations
summary: >-
  Pleasanter provided fails to properly verify passwords in LDAP authentication
  when processing specially crafted requests under certain configurations.  If
  exploited, an attacker may bypass LDAP authentication by providing only a
  valid Lo…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-304
vendor: Implem Inc.
product: Pleasanter
affected:
  - Pleasanter >= 1.1.0.0 <= 1.5.9.0
published: '2026-10-26'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T08:59:05.476Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-113438'
references:
  - url: 'https://pleasanter.org/news/vulnerability-update-20261023/'
  - url: 'https://jvn.jp/en/jp/JVN82312317/'
tags:
  - cve.org
ingestedAt: '2026-10-26T09:22:35.520Z'
---

## Overview

Pleasanter provided fails to properly verify passwords in LDAP authentication when processing specially crafted requests under certain configurations.  If exploited, an attacker may bypass LDAP authentication by providing only a valid Login ID, without a password. As a result, an attacker may view, alter or delete information stored in the product with the privilege of the account used to log in.

## Affected

- `Pleasanter >= 1.1.0.0 <= 1.5.9.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.