OptimiDoc Server (On-Premise) stores credentials for external services in cleartext. An authenticated administrator can view previously configured service passwords, including SMTP, FTP (for scan delivery), Active Directory (for user list import), and SharePoint credentials, in cleartext via the web administration panel page source, allowing exposure of sensitive third-party authentication data.


This issue was fixed in version 26.08

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
OptimiDoc OptimiDoc Server unaffected
Version Status Constraints
0 affected < 26.08

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Optimidoc Subscribe
Optimidoc Server Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://cert.pl/en/posts/2026/09/CVE-2026-15933 cve-icon
https://optimidoc.com/category/optimidoc-server/ cve-icon
History

Thu, 03 Sep 2026 10:30:00 +0000

Type Values Removed Values Added
Description OptimiDoc Server (On-Premise) stores credentials for external services in cleartext. An authenticated administrator can view previously configured service passwords, including SMTP, FTP (for scan delivery), Active Directory (for user list import), and SharePoint credentials, in cleartext via the web administration panel page source, allowing exposure of sensitive third-party authentication data. This issue was fixed in version 26.08
Title Cleartext Storage of Sensitive Credentials in OptimiDoc Server (On-Premise)
First Time appeared Optimidoc
Optimidoc optimidoc Server
Weaknesses CWE-256
CPEs cpe:2.3:a:optimidoc:optimidoc_server:*:*:*:*:*:*:*:*
Vendors & Products Optimidoc
Optimidoc optimidoc Server
References
Metrics cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: CERT-PL

Published:

Updated: 2026-09-03T10:09:33.690Z

Reserved: 2026-07-16T07:57:08.379Z

Link: CVE-2026-15933

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses