Pleasanter EUVD-2026-109680

Exploitation requires that the Pleasanter instance be configured to use LDAP authentication - the description scopes the flaw to 'certain configurations,' so deployments not using LDAP are not affected. The attacker must supply a valid Login ID for an existing account; the password check is bypassed, but a correct Login ID is still a prerequisite, which bounds the attack to accounts whose identifiers are known or guessable. The precise trigger - what makes a request 'specially crafted' - is not described in the available sources. Resulting access is limited to the privileges of the targeted account, not administrative or system-level by default.

This is a moderate-severity authentication bypass (CVSS 4.0 base 6.9) in Pleasanter's LDAP authentication path. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N) indicates a network-reachable flaw requiring no privileges or user interaction, which aligns with the description: an attacker supplies only a valid Login ID and no password to log in as that account. The impact metrics are rated Low for confidentiality and integrity and None for availability, consistent with the fact that an attacker gains only the privileges of the compromised account rather than full system control - so the real-world blast radius scales with which accounts can be targeted. The vuln.today decision label is 'this_month', not act_now or emergency, which signals meaningful but non-critical urgency. No EPSS score, no CISA KEV listing, and no public exploit reference are present in the input, so there is no signal of active or widespread exploitation; this reads as a genuine but bounded priority rather than a high-CVSS/low-real-risk inflation. Two caveats limit certainty: exploitation only occurs 'under certain configurations' (LDAP auth enabled), so environments not using LDAP are unaffected, and the attacker must still know a valid Login ID. The CVSS vector marks PR:N (no authentication), consistent with the bypass bypassing the credential check entirely.

An attacker who knows or guesses a valid Pleasanter Login ID sends a specially crafted authentication request to an instance configured to use LDAP, omitting the password, and is logged in as that account. Once authenticated, the attacker can read, modify, or delete the data accessible to that account. No public exploit code is identified in the available sources.