Pleasanter fixes LDAP login bypass CVE-2026-113438 in 1.5.9.1

Pleasanter fixes LDAP login bypass CVE-2026-113438 in 1.5.9.1

23 October 2026: Implem has fixed CVE-2026-113438 in Pleasanter, its open-source low-code platform for business applications, a flaw in LDAP authentication (CVSS 4.0 base score 6.9, CVSS 3.0 6.5) that lets anyone who knows a valid login ID sign in as that user without the password. No exploitation has been reported. The fix is version 1.5.9.1, released today; 1.5.9.0, released on 13 October, does not contain it.

Not yet independently verified. Neither JVN nor the vendor reports exploitation, and the vendor's workaround for those who cannot upgrade is given only on request, so we cannot describe it. We will update this when it can be confirmed, and remove this note.

Which installations are exposed

Every version from 1.1.0.0 to 1.5.9.0 is affected, in both Community and Enterprise editions, but only when LDAP authentication is switched on and two conditions meet. The first is how Pleasanter runs: on Linux, including the Docker image, or on Windows with the DsProvider setting in Authentication.json set to "Novell" (a setting added in 1.3.41.0). The second is the directory behind it: Active Directory, or OpenLDAP, 389 Directory Server and similar servers that allow anonymous bind.

Pleasanter setup	Active Directory	LDAP with anonymous bind allowed	LDAP with anonymous bind refused
Linux, including Docker	affected	affected	not affected
Windows, DsProvider "Novell"	affected	affected	not affected
Windows, DsProvider default (null)	not affected	not affected	not affected

Local accounts, SAML, passkeys, two-step login by email or TOTP and integrated Windows authentication are not affected. Where Authentication.json sets the provider to "LDAP+Local", only the users who sign in through LDAP are exposed. Implem says its private cloud and the hosted Pleasanter.net service have no LDAP configured and need no action.

How the bypass works

Normal use of the login screen does not trigger it. A request crafted into a shape the screen never sends is not validated properly on the server, and depending on how the directory answers, the login is treated as successful without the password being checked. No special privileges or preparation are needed beyond reaching the login page, so an internet-facing Pleasanter with Active Directory behind it is the case to fix first. An attacker gets the impersonated user's rights: reading, changing and deleting whatever records that user can reach.

What Implem asks customers to do

Upgrade to 1.5.9.1 or later, following the manual's version-up or migration procedure. Customers who cannot upgrade for operational reasons are asked to contact Implem, which says it will advise on a workaround case by case; JVN likewise notes the developer recommends a workaround without publishing it. A quicker interim check is the directory side: refusing anonymous bind on OpenLDAP or 389 Directory Server takes those combinations out of scope, although that does not help Active Directory installations.

The report came from the developer to IPA under Japan's disclosure scheme, with JPCERT/CC coordinating. Our low-code development platform category lists 11 products.

Company profile on TrustList: Implem Inc.

Related on TrustList:

• Studio breach may have exposed every account's API keys and form data

Sources

• JVN#82312317: Authentication bypass in Pleasanter LDAP authentication, 23 October 2026
• Pleasanter: Authentication bypass vulnerability in Pleasanter LDAP authentication, 23 October 2026