CVE-2021-3825 CRITICAL

CVE-2021-3825: Missing Authorization Checks in LiderAhenk

Vendor Tubitak
Product Lider
Weakness CWE-306 · Missing auth
Published October 1, 2021
Last update May 18, 2026
View on NVD All CVEs

CVSS base score

9.6/10
Attack vector Adjacent
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

On 2.1.15 version and below of Lider module in LiderAhenk software is leaking it's configurations via an unsecured API. An attacker with an access to the configurations API could get valid LDAP credentials.

Key dates

02Disclosure timeline

October 1, 2021 CVE published
May 18, 2026 Record updated