CVE-2026-19271: CWE-90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') in TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk

This vulnerability, identified as CWE-90 (LDAP Injection), occurs in Liderahenk versions starting at 3.4.0 before 3.5.5. It allows an attacker to manipulate LDAP queries by injecting special elements that are not properly neutralized, potentially leading to unauthorized access to sensitive information. The vulnerability has a CVSS v3.1 base score of 7.5, reflecting its network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact without affecting integrity or availability. No vendor advisory or patch information is currently available, and the product is not a cloud service, so remediation must be managed by the user or organization.

Successful exploitation of this LDAP Injection vulnerability could allow an attacker to retrieve sensitive information from the LDAP directory, compromising confidentiality. There is no indication of impact on integrity or availability. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently documented, users should monitor vendor communications for updates. Until a patch is available, cautious handling of LDAP queries and input validation may reduce risk, but no vendor-endorsed mitigations are specified.