Vulnerability · Published Sep 3, 2026 · Assigned by CERT-PL

CVE-2026-15933Cleartext Storage of Sensitive Credentials in OptimiDoc Server (On-Premise)

Medium 6.9

In plain English

A medium-severity security flaw in OptimiDoc Server from OptimiDoc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.5%top 54.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OptimiDoc Server (On-Premise) stores credentials for external services in cleartext. An authenticated administrator can view previously configured service passwords, including SMTP, FTP (for scan delivery), Active Directory (for user list import), and SharePoint credentials, in cleartext via the web administration panel page source, allowing exposure of sensitive third-party authentication data. This issue was fixed in version 26.08

Affected products (as reported)

Vendor	Product	Versions
OptimiDoc	OptimiDoc Server	0 – before 26.08

Weakness: CWE-256 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://cert.pl/en/posts/2026/09/CVE-2026-15933 third-party-advisory
https://optimidoc.com/category/optimidoc-server/ product