Vulnerability · Published Oct 26, 2026 · Assigned by jpcert
CVE-2026-113438
Medium 6.5
In plain English
A medium-severity security flaw in Pleasanter from Implem Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).
Official description
Pleasanter provided fails to properly verify passwords in LDAP authentication when processing specially crafted requests under certain configurations. If exploited, an attacker may bypass LDAP authentication by providing only a valid Login ID, without a password. As a result, an attacker may view, alter or delete information stored in the product with the privilege of the account used to log in.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Implem Inc. | Pleasanter | 1.1.0.0 – through 1.5.9.0 |
Weakness: CWE-304 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N