CVE-2026-1836: Stored credentials in Redmine

Published Jun 12, 2026

Updated

The system stores the username and password from the login form after submitting the request. This could allow an attacker with access to the platform to return to the browser and view the login credentials.

Affected Software

1 affected component

Redmine Redmine

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Redmine to a version that resolves this vulnerability.
Fixed in 6.0.7
Upgrade
Upgrade Redmine to a version that resolves this vulnerability.
Fixed in 5.1.10
Upgrade
Upgrade Redmine to a version that resolves this vulnerability.
Fixed in 5.0.14

Event History

Jun 12, 2026

CVE Published

via MITRE·01:23 PM

Data Sourced

via MITRE·01:23 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·02:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-1836?

CVE-2026-1836 has a medium severity rating of 5.3 according to the CVSS scoring system.

How do I fix CVE-2026-1836?

To address CVE-2026-1836, upgrade to Redmine versions 6.0.7, 5.1.10, or 5.0.14 where the vulnerability has been patched.

What type of vulnerability is CVE-2026-1836?

CVE-2026-1836 is classified as a stored credentials vulnerability that exposes login information.

What risks are associated with CVE-2026-1836?

The risk associated with CVE-2026-1836 includes potential unauthorized access to account credentials exposed in the browser.

When was CVE-2026-1836 published?

CVE-2026-1836 was published on June 12, 2026.