Full Report
Plaintext Storage of a Password vulnerability (CVE-2026-50641) has been found in Streamsoft Business Intelligence software.
Analysis Summary
# Vulnerability: Plaintext Password Storage in Streamsoft Business Intelligence
## CVE Details
- **CVE ID**: CVE-2026-50641
- **CVSS Score**: Not explicitly provided in the article (Estimated High based on CWE-256)
- **CWE**: CWE-256 (Plaintext Storage of a Password)
## Affected Systems
- **Products**: Streamsoft Business Intelligence (BI)
- **Versions**: All versions prior to 6.8.0.0
- **Configurations**: Standard installations utilizing the internal user database.
## Vulnerability Description
Streamsoft Business Intelligence software fails to encrypt or hash user credentials stored within its database. Passwords are saved in **plaintext format**, meaning any person or process with read access to the database (through SQL injection, compromised backup files, or administrative access) can view user passwords directly without requiring decryption or cracking efforts.
## Exploitation
- **Status**: Not exploited (No reports of active exploitation in the wild at this time).
- **Complexity**: Low (Requires access to the database or storage medium).
- **Attack Vector**: Local/Adjacent (Typically requires access to the server infrastructure or backend database).
## Impact
- **Confidentiality**: High (Total disclosure of user credentials).
- **Integrity**: Low (While the flaw is a storage issue, compromised credentials can lead to unauthorized data modification).
- **Availability**: Low (Compromised credentials could lead to account lockout or unauthorized administrative actions).
## Remediation
### Patches
- **Update to Version 6.8.0.0**: The vendor has released version 6.8.0.0 which addresses this vulnerability.
### Workarounds
- **Mandatory Password Change**: Upon upgrading to version 6.8.0.0, all users must change their passwords during their first login to ensure new credentials are stored securely (hashed).
- **Database Access Control**: Until an upgrade is possible, strictly limit access to the database layer to the minimum required service accounts.
## Detection
- **Indicators of Compromise**: Manual inspection of the user table within the Streamsoft BI database. If passwords are human-readable, the system is vulnerable.
- **Detection methods**: Standard database auditing and monitoring for unauthorized queries against user credential tables.
## References
- **Vendor Advisory**: hxxps[://]cert[.]pl/en/posts/2026/07/vulnerability-in-streamsoft-business-intelligence-software/
- **CVD Program**: hxxps[://]cert[.]pl/en/cvd
- **CVE Record**: hxxps[://]www[.]cve[.]org/CVERecord?id=CVE-2026-50641