CVE-2025-27231

Name of the Vulnerable Software and Affected Versions Versions prior to the fix where the 'Bind password' value is reset on 'Host' change.

Description A Super Admin account can potentially leak the LDAP 'Bind password' value by changing the LDAP 'Host' to a rogue LDAP server. The 'Bind password' value cannot be read after saving, but this manipulation allows unauthorized access. The issue is mitigated by resetting the 'Bind password' value when the 'Host' is changed.

Recommendations Ensure the 'Bind password' value is reset on 'Host' change.