CVE-2026-15933: Cleartext Storage of Sensitive Credentials in OptimiDoc Server (On-Premise)
OptimiDoc Server (On-Premise) stores credentials for external services in cleartext. An authenticated administrator can view previously configured service passwords, including SMTP, FTP (for scan delivery), Active Directory (for user list import), and SharePoint credentials, in cleartext via the web administration panel page source, allowing exposure of sensitive third-party authentication data.
This issue was fixed in version 26.08
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OptimiDoc Server (On-Premise)to a version that resolves this vulnerability.Fixed in 26.08
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated OptimiDoc Server (On-Premise) administrator can exploit it through the web administration panel. The exposed credentials are those previously configured for external services.
Which credentials may be exposed?
The affected configuration can expose SMTP, FTP scan-delivery, Active Directory user-list import, and SharePoint credentials. These are visible in cleartext in the web administration panel page source.
Are deployments running version 26.08 affected?
No. The issue was fixed in version 26.08.
What should be done if credentials may already have been exposed?
Treat previously configured external-service passwords as potentially disclosed and rotate the affected SMTP, FTP, Active Directory, and SharePoint credentials.