CVE-2026-15933CWE-256

CVE-2026-15933

published September 3, 2026

CVSS
6.9
EPSS
0%
Percentile
29.0
In the wild
Unconfirmed
What it is

OptimiDoc Server (On-Premise) stores credentials for external services in cleartext. An authenticated administrator can view previously configured service passwords, including SMTP, FTP (for scan delivery), Active Directory (for user list import), and SharePoint credentials, in cleartext via the web administration panel page source, allowing exposure of sensitive third-party authentication data.

This issue was fixed in version 26.08

The record
Technical detail
CVSS
6.9 · NONE
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00360 · 29.0th percentile
Weakness
CWE-256 · Plaintext Storage of a Password
Published
2026-09-03T17:04Z
References (2)
https://cert.pl/en/posts/2026/09/CVE-2026-15933 · [email protected]https://optimidoc.com/category/optimidoc-server/ · [email protected]
EPSS history
Timeline
  • 05 SEP 03:40Z
    EPSS moved — → 0%
    epss
  • 03 SEP 10:09Z
    Cleartext Storage of Sensitive Credentials in OptimiDoc Server (On-Premise)
    cvelistv5