Authentication Bypass Vulnerability in LDAP Authentication of Pleasanter
Release date: October 23, 2026
Overview¶
An authentication bypass vulnerability has been found in the LDAP authentication feature of Pleasanter. Under certain conditions, it allows a login without correctly verifying the password.
If exploited, a third party who knows a valid login ID can log in as that user without knowing the correct password, and may view, tamper with, or delete information.
Affected environments¶
1. Authentication methods that are not affected¶
If you use the following authentication methods, you are not affected by this vulnerability.
- Local authentication (the standard authentication of Pleasanter)
- SAML authentication
- Passkey authentication
- Two-factor authentication (email, TOTP)
- Integrated Windows authentication
* To check the authentication method, see "Provider" in Authentication.json. If it is set to "LDAP" or "LDAP+Local", your environment uses LDAP authentication. In that case, check "2. Affected combinations".
* If you use LDAP authentication together with local authentication (Provider: "LDAP+Local"), only users who log in with LDAP authentication are affected.
2. Affected combinations¶
If you use LDAP authentication, whether you are affected depends on the combination of the Pleasanter configuration and the LDAP server it connects to, as follows.
| Pleasanter configuration | Active Directory | OpenLDAP, etc. (anonymous bind allowed) | OpenLDAP, etc. (anonymous bind denied) |
|---|---|---|---|
| (1) Linux environment (including the Docker edition) | Affected | Affected | Not affected |
| (2) Windows environment with "DsProvider" set to "Novell" | Affected | Affected | Not affected |
| (3) Windows environment with "DsProvider" at its default value (null) | Not affected | Not affected | Not affected |
In summary, you are affected if both of the following apply.
- Pleasanter runs in a Linux environment (including the Docker edition), or in a Windows environment with "DsProvider"* set to "Novell"
- The LDAP server it connects to is Active Directory, or OpenLDAP, 389 Directory Server, etc. that allows anonymous bind
3. Affected versions¶
Version 1.1.0.0 and later are affected. This applies to both Community Edition and Enterprise Edition.
* DsProvider: A setting in Authentication.json, added in 1.3.41.0. If it is not specified, the default value (null) is used.
For the settings, see the following manual.
Vulnerability description¶
This does not occur through normal operations on the login screen.
However, when a request crafted into a form that normal operations do not send is sent to the authentication process, the server did not sufficiently validate the request. As a result, depending on the settings of the LDAP server it connects to, the authentication could be judged successful without correctly verifying the password.
Any third party who can access the login screen can exploit this without special privileges or preparation.
Threat posed by the vulnerability¶
By sending a crafted request, a malicious third party can log in as a user without knowing the correct password.
As a result, information registered in Pleasanter may be viewed, tampered with, or deleted with that user's permissions.
Countermeasure¶
1. For customers whose environment meets the conditions in "Affected environments"¶
Countermeasure: Version up¶
- Please upgrade to 1.5.9.1 (released October 23, 2026), which fixes this vulnerability, or later.
- 1.5.9.0 (released October 13, 2026) does not include the fix for this vulnerability. If you use 1.5.9.0, please upgrade to 1.5.9.1 or later.
- For the upgrade procedure, see the following manuals. Support users can consult us about upgrading through the dedicated web inquiry window.
If upgrading is difficult¶
- If upgrading is difficult due to circumstances such as system operation, please contact us at the contact information below. We will ask about your environment and circumstances and advise you on how to respond.
2. For customers using the private cloud¶
- Not affected, because LDAP authentication is not configured. We have confirmed this, so no action is required on your part.
3. For customers using Pleasanter.net¶
- Not affected, because LDAP authentication is not configured. We have confirmed this, so no action is required on your part.
Change log¶
2026.10.23 This vulnerability information has been made public.
Contact information¶
If you have any questions about this matter, please contact us via the form below.
Inquiry form: https://pleasanter.org/contact/