1. Basic Information

Article Title : Authentication Bypass Vulnerability in Pleasanter LDAP Authentication

Published By : JVN / JPCERT/CC and IPA

Publication Date : 2026-10-23

Source : JVN / JPCERT/CC and IPA

Related Information : Imprim Inc.

Associated Malware : Not identified

Associated Threat Group : Not identified

Associated CVE : CVE-2026-113438

Affected Products : Pleasanter

Severity : Medium

Severity Basis : Although it requires a specific LDAP configuration and a valid user ID, the issue can be exploited over the network without authentication or user interaction, impacting business data. Organizations using this software should verify whether their configuration is affected.

2. Overview

In specific LDAP configurations of Pleasanter versions 1.1.0.0 through 1.5.9.0, crafted requests allow attackers to log in as a valid user without password verification, potentially leading to the viewing, tampering, or deletion of data within the user's privilege level.

3.…