CVE-2026-19271 - Vulnerability Details - OpenCVE

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk allows LDAP Injection.

This issue affects Liderahenk: from 3.4.0 before 3.5.5.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable yes

Technical Impact partial

No data.

No data.

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0916

History

Wed, 26 Aug 2026 16:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 26 Aug 2026 14:15:00 +0000

Type	Values Removed	Values Added
Description		Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk allows LDAP Injection. This issue affects Liderahenk: from 3.4.0 before 3.5.5.
Title		Blind LDAP Injection in Sign-In Endpoint in TÜBİTAK BİLGEM's Liderahenk
Weaknesses		CWE-90
References		https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0916
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}`

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: TR-CERT

Published: 2026-08-26T13:44:57.748Z

Updated: 2026-08-26T15:43:48.093Z

Reserved: 2026-08-07T14:23:01.592Z

Link: CVE-2026-19271

Vulnrichment

Updated: 2026-08-26T15:43:41.410Z

NVD

Status : Deferred

Published: 2026-08-26T14:17:08.500

Modified: 2026-08-26T16:51:19.490

Link: CVE-2026-19271

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-90

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-19271", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "state": "PUBLISHED", "assignerShortName": "TR-CERT", "dateReserved": "2026-08-07T14:23:01.592Z", "datePublished": "2026-08-26T13:44:57.748Z", "dateUpdated": "2026-08-26T15:43:48.093Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2026-08-26T13:44:57.748Z"}, "title": "Blind LDAP Injection in Sign-In Endpoint in T\u00dcB\u0130TAK B\u0130LGEM's Liderahenk", "datePublic": "2026-08-26T13:36:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-90", "description": "CWE-90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-136", "descriptions": [{"lang": "en", "value": "CAPEC-136 LDAP Injection"}]}], "affected": [{"vendor": "T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute", "product": "Liderahenk", "versions": [{"status": "affected", "version": "3.4.0", "lessThan": "3.5.5", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute Liderahenk allows LDAP Injection.\n\nThis issue affects Liderahenk: from 3.4.0 before 3.5.5.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute Liderahenk allows LDAP Injection.<p>This issue affects Liderahenk: from 3.4.0 before 3.5.5.</p>"}]}], "references": [{"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0916", "tags": ["government-resource"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "HIGH", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}}], "credits": [{"lang": "en", "value": "Emre DO\u011eAN", "type": "finder"}], "source": {"defect": ["TR-26-0916"], "advisory": "TR-26-0916", "discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-26T15:43:25.301919Z", "id": "CVE-2026-19271", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-26T15:43:48.093Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-19271", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "state": "PUBLISHED", "assignerShortName": "TR-CERT", "dateReserved": "2026-08-07T14:23:01.592Z", "datePublished": "2026-08-26T13:44:57.748Z", "dateUpdated": "2026-08-26T15:43:48.093Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2026-08-26T13:44:57.748Z"}, "title": "Blind LDAP Injection in Sign-In Endpoint in T\u00dcB\u0130TAK B\u0130LGEM's Liderahenk", "datePublic": "2026-08-26T13:36:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-90", "description": "CWE-90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-136", "descriptions": [{"lang": "en", "value": "CAPEC-136 LDAP Injection"}]}], "affected": [{"vendor": "T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute", "product": "Liderahenk", "versions": [{"status": "affected", "version": "3.4.0", "lessThan": "3.5.5", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute Liderahenk allows LDAP Injection.\n\nThis issue affects Liderahenk: from 3.4.0 before 3.5.5.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute Liderahenk allows LDAP Injection.<p>This issue affects Liderahenk: from 3.4.0 before 3.5.5.</p>"}]}], "references": [{"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0916", "tags": ["government-resource"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "HIGH", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}}], "credits": [{"lang": "en", "value": "Emre DO\u011eAN", "type": "finder"}], "source": {"defect": ["TR-26-0916"], "advisory": "TR-26-0916", "discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-19271", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-26T15:43:25.301919Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-26T15:43:41.410Z"}}]}}