Liderahenk CVE-2026-19271

No special conditions are required for exploitation based on the CVSS vector AV:N/AC:L/PR:N/UI:N - this is a remote unauthenticated attack against network-accessible Liderahenk instances running versions 3.4.0 through 3.5.4. Exploitation is limited to environments where the Liderahenk management interface is reachable over the network; deployments isolated behind strict network perimeters or VPNs reduce exposure to trusted-network attackers only. Exploitation produces confidentiality impact only - an attacker cannot modify directory data or disrupt service via this vector alone.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N scores 7.5 (High), reflecting a remotely exploitable, unauthenticated flaw with no user interaction and high confidentiality impact, but no integrity or availability degradation. This signal alone places it in a realistic exploitation tier: network reachable, no authentication barrier, and low attack complexity together mean any internet-connected deployment is vulnerable to automated probing. No EPSS probability was supplied, and this product is absent from the CISA KEV catalog, so active exploitation is not confirmed. No public POC has been reported. The confidentiality-only impact (I:N, A:N) limits blast radius compared to RCE-class flaws, but LDAP directory exfiltration in government or institutional environments carries significant secondary risk - exposed credentials, organizational structure, and account enumerations can fuel subsequent phishing or credential-stuffing campaigns. The TR-CERT advisory origin is consistent with a domestic government-sector disclosure pipeline rather than broad commercial researcher activity.

An unauthenticated attacker sends an HTTP request to a Liderahenk management endpoint that accepts a username or search parameter, injecting LDAP metacharacters such as '*)(&' to modify the filter logic. The manipulated query causes the directory server to return all user entries rather than the intended single match, leaking account names, email addresses, or hashed credentials from the organizational LDAP tree. No prior authentication or user interaction is required, and the low complexity means this can be automated via simple scripted enumeration.