CVE-2026-15933: CWE-256 Plaintext Storage of a Password in OptimiDoc OptimiDoc Server
Description
OptimiDoc Server (On-Premise) stores credentials for external services in cleartext. An authenticated administrator can view previously configured service passwords, including SMTP, FTP (for scan delivery), Active Directory (for user list import), and SharePoint credentials, in cleartext via the web administration panel page source, allowing exposure of sensitive third-party authentication data. This issue was fixed in version 26.08
CVSS v4.0
Score 6.9medium
Affected software
OptimiDoc
OptimiDoc Server
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-15933 describes a vulnerability in OptimiDoc Server (On-Premise) where credentials for external services are stored in plaintext. An authenticated administrator can retrieve these passwords by inspecting the web administration panel's page source, exposing sensitive authentication data for services such as SMTP, FTP, Active Directory, and SharePoint. This vulnerability is classified under CWE-256 (Plaintext Storage of a Password). The vendor fixed this issue in version 26.08.
Potential Impact
The vulnerability allows an authenticated administrator to access plaintext passwords for critical external services configured in OptimiDoc Server. This exposure could lead to unauthorized access to these third-party services if the administrator account is compromised or misused. The impact is limited to users with administrative privileges on the server.
Mitigation Recommendations
Upgrade OptimiDoc Server to version 26.08 or later, where this vulnerability has been fixed. No other mitigation or temporary workaround is indicated. Since this is an on-premise product, administrators should apply the official fix promptly to prevent exposure of sensitive credentials.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- CERT-PL
- Date Reserved
- 2026-07-16T07:57:08.379Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a994df8acd9273b49cc69ba
Added to database: 09/03/2026, 10:37:44 UTC
Last enriched: 09/07/2026, 13:13:59 UTC
Last updated: 10/18/2026, 18:48:18 UTC
Views: 88
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.