Pleasanter CVE-2026-113438 allows passwordless login under specific LDAP setups
Pleasanter 1.1.0.0 through 1.5.9.0 can be bypassed under specific LDAP configurations (Provider set to LDAP or LDAP+Local, DsProvider Novell, and Active Directory or OpenLDAP/389 DS allowing anonymous binds), letting attackers log in with a valid ID and no password. CVE-2026-113438 enables viewing, tampering or deleting data within that user's privileges; the fix is in 1.5.9.1.
- Affects Pleasanter 1.1.0.0–1.5.9.0 with LDAP or LDAP+Local in Authentication.json
- Requires a valid login ID and AD or OpenLDAP/389 DS with anonymous binds
- Fixed in version 1.5.9.1; 1.5.9.0 does not include the patch
- Windows deployments with default DsProvider=null are not affected
Read next
Security