Pleasanter provided fails to properly verify passwords in LDAP authentication when processing specially crafted requests under certain configurations. If exploited, an attacker may bypass LDAP authentication by providing only a valid Login ID, without a password. As a result, an attacker may view, alter or delete information stored in the product with the privilege of the account used to log in.

Pleasanter provided fails to properly verify passwords in LDAP authentication when processing specially crafted requests under certain configurations. If exploited, an attacker may bypass LDAP authentication by providing only a valid Login ID, without a password. As a result, an attacker may view, alter or delete information stored in the product with the privilege of the account used to log in.

Pleasanter provided by Implem Inc. fails to properly verify passwords in LDAP authentication when processing specially crafted requests under certain configurations.<a href='https://cwe.mitre.org/data/definitions/304.html' target='_blank'></a><ul><li>Missing Critical Step in Authentication (CWE-304) - CVE-2026-113438</li></ul>Implem Inc. reported this vulnerability to IPA to notify users of its solution through JVN. JPCERT/CC and Implem Inc. coordinated under the Information Security Early Warning Partnership.