Cybozu Garoon prior to 4.2.2 allows remote malicious users to bypass login authentication via vectors related to API use.
cybozu garoon