Hi

From https://docs.inspircd.org/security/2026-01/
| The LDAP modules before v4.11.0 do not escape user-provided values
| before using them in LDAP search filters. This vulnerability can be
| used to access an LDAP-restricted server (if ldapauth is used) or
| gain access to a LDAP-restricted operator account (if ldapoper is
| used) without knowing the correct username if the password of any
| user is known.

Fixes via
https://github.com/inspircd/inspircd/commit/b7e5357b144c2e20c72431e22f0f2b13e5be82ce
and
https://github.com/inspircd/inspircd/commit/6319ae4fb8c10dabc9464ad49faec532096fbcb5
.

Regards,
Salvatore