CVE-2026-19051: CWE-256 Plaintext storage of a password in Menulux Software Inc. Menulux Portal

This vulnerability (CVE-2026-19051) involves plaintext storage of passwords in Menulux Portal, which allows attackers with some privileges to retrieve sensitive embedded data. The issue affects all versions prior to build 20260903211448. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) indicates network attack vector, low attack complexity, requires low privileges, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. No vendor advisory or patch information is currently available to confirm remediation status.

The vulnerability exposes user passwords stored in plaintext, leading to a high confidentiality impact if exploited. Attackers with low privileges on the network could retrieve sensitive credentials, potentially compromising user accounts. Integrity impact is low, and availability is not affected. No active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the Menulux Portal environment to trusted users only and monitor for unauthorized access attempts. Avoid storing sensitive passwords in plaintext and consider additional protective controls such as encryption or vaulting of credentials if possible.