Vulnerability · Published Jun 22, 2026 · Assigned by LY-Corporation
CVE-2026-11748
Medium 6.9
In plain English
A medium-severity security flaw in Central Dogma from LY Corporation. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A vulnerability has been identified in centraldogma-server-auth-shiro versions prior to 0.84.0, where the SearchFirstActiveDirectoryRealm substitutes the login username into an LDAP search filter without neutralizing LDAP filter metacharacters, allowing an unauthenticated attacker to manipulate the filter to cause authentication confusion and enumerate the directory structure.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | com.linecorp.centraldogma:centraldogma-server-auth-shiro | 0.84.0 | GHSA-98q5-5qh2-7w75 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| LY Corporation | Central Dogma | see references |
Weakness: CWE-90 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N