CVE-2026-15933

The record

OptimiDoc Server (On-Premise) stores credentials for external services in cleartext. An authenticated administrator can view previously configured service passwords, including SMTP, FTP (for scan delivery), Active Directory (for user list import), and SharePoint credentials, in cleartext via the web administration panel page source, allowing exposure of sensitive third-party authentication data. This issue was fixed in version 26.08

Affected packages

Related vulnerabilities

• CVE-2026-19051 Plaintext storage of a password vulnerability in Menulux Software Inc. CWE-256
• CVE-2021-38489 HDD password plaintext is stored in a UEFI variable. CWE-256
• CVE-2026-55164 Lemur manages TLS certificate creation. CWE-256
• CVE-2026-14867 Credentials of built-in users are insecurely stored in the User directory of PcVue… CWE-256
• CVE-2026-57302 Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml… CWE-256
• CVE-2026-50268 Steeltoe is an open source project that provides a collection of libraries that helps… CWE-256
• CVE-2024-39575 update_disk_psu_baseline.sh requires password in plain text CWE-256
• CVE-2024-45636 IBM Security QRadar EDR 3.12 through 3.12.24 stores user credentials in plain text which… CWE-256