Full Report
Plaintext Storage of a Password vulnerability (CVE-2026-15933) has been found in OptimiDoc Server (On-Premise) software.
Analysis Summary
# Morning News Roll-up 2026-09-03
## Overview
A critical vulnerability has been disclosed in OptimiDoc Server (On-Premise) involving the insecure storage of administrative credentials. The vulnerability allows for the exposure of third-party service passwords in cleartext.
## Top Stories
### Plaintext Storage of Passwords in OptimiDoc Server (CVE-2026-15933)
- Summary: OptimiDoc Server (On-Premise) was found to store credentials for external services in cleartext. An authenticated administrator could view passwords for SMTP, FTP, Active Directory, and SharePoint directly through the web administration panel's page source. This flaw has been addressed in the latest software update.
- Source: hxxps://cert[.]pl/en/posts/2026/09/CVE-2026-15933/
---
# Main Topic
**CVE-2026-15933: Plaintext Storage of Credentials in OptimiDoc Server (On-Premise)**
## Key Points
- The vulnerability is classified as **CWE-256: Plaintext Storage of a Password**.
- Sensitive credentials for integrated third-party services (SMTP, FTP, Active Directory, SharePoint) are stored without encryption or hashing.
- The flaw allows an authenticated administrator to retrieve these passwords by simply viewing the **web administration panel page source**.
- This exposure could lead to lateral movement or unauthorized access to critical enterprise infrastructure (e.g., Active Directory or document repositories).
## Threat Actors
- No specific threat actors or active exploitation campaigns were identified in the report. The discovery is attributed to a security researcher (Paweł Różański) via a coordinated disclosure process.
## TTPs
- **Credential Access:** Extraction of cleartext credentials from configuration pages.
- **Administrative Access Requirement:** The attacker must have authenticated administrator privileges to the OptimiDoc web panel.
- **Exploitation Method:** Inspection of the web page source code within the browser to view sensitive data fields that are not properly masked or encrypted at rest/in transit to the UI.
## Affected Systems
- **Vendor:** OptimiDoc
- **Product:** OptimiDoc Server (On-Premise)
- **Vulnerable Versions:** All versions prior to **26.08**
## Mitigations
- **Update Software:** Immediately upgrade OptimiDoc Server (On-Premise) to version **26.08** or later, where this issue has been resolved.
- **Credential Rotation:** Following the update, it is highly recommended to rotate all passwords that were previously stored in the OptimiDoc Server (SMTP, FTP, AD, and SharePoint accounts).
- **Principle of Least Privilege:** Limit the number of users with administrative access to the OptimiDoc web panel to reduce the attack surface.
## Conclusion
CVE-2026-15933 represents a significant risk to organizational secrets management. While exploitation requires administrative access, the resulting exposure of Active Directory and SharePoint credentials provides a high-impact opportunity for lateral movement. Immediate patching to version 26.08 is required to secure stored credentials.