Plaintext storage of a password vulnerability in Menulux Software Inc. (CVE-2026-19051)

CVE-2026-19051 describes a vulnerability in Menulux Portal where passwords are stored in plaintext, enabling unauthorized retrieval of embedded sensitive data. This weakness corresponds to CWE-256, indicating improper storage of credentials. The vulnerability affects Menulux Portal versions prior to 20260903211448. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, requiring low privileges but no user interaction, with high confidentiality impact, low integrity impact, and no availability impact.

An attacker with low privileges can remotely exploit this vulnerability to access plaintext passwords stored within the Menulux Portal, leading to a high confidentiality breach. Integrity impact is low and availability is not affected. This exposure of sensitive credentials can facilitate further unauthorized access or lateral movement within affected environments.

No patch or official fix information is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is provided, restrict access to the Menulux Portal and monitor for unauthorized access attempts involving credential retrieval.