EUVD-2026-59963
GHSA-4vx7-c7qw-2vx4
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable auth bypass with no privileges gives AV:N/AC:L/PR:N; the information-disclosure tag makes confidentiality primary (C:H), with only limited integrity and no confirmed availability impact from the sparse description.
Primary rating from Vendor (vendor:ubuntu).
CVSS VectorVendor: vendor:ubuntu
Lifecycle Timeline
4DescriptionCVE.org
security update
AnalysisAI
Authentication bypass in LemonLDAP::NG (CWE-305) allows remote unauthenticated attackers to defeat a primary authentication control and access protected resources, tagged by the reporter as leading to information disclosure. All maintained branches are affected, with fixes shipped in 2.23.3, 2.21.5, and 2.16.9; the issue was disclosed via oss-security and packaged by Ubuntu. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no special conditions - remote unauthenticated exploitation against network-reachable LemonLDAP::NG portal/handler endpoints. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals conflict and should be weighed carefully. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to LemonLDAP::NG 2.23.3, 2.21.5, or 2.16.9 depending on your installed branch (see the OW2 GitLab release pages linked above and the disclosure at https://seclists.org/oss-sec/2026/q3/505 ). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify and inventory all LemonLDAP::NG deployments across versions 2.16.x, 2.21.x, and 2.23.x, noting which systems are internet-facing. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-305 – Authentication Bypass by Primary Weakness
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today