OptimiDoc Server exposes cleartext service credentials
OptimiDoc Server (On-Premise) stored SMTP, FTP, AD, and SharePoint credentials in cleartext, viewable by admins via page source; fixed in v26.08.
Sourcecert.pl — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated disclosure of a vulnerability in OptimiDoc Server (On-Premise), tracked as CVE-2026-15933, in which credentials for integrated external services—SMTP, FTP (used for scan delivery), Active Directory (used for user list import), and SharePoint—were stored in cleartext. An authenticated administrator could retrieve these previously configured service passwords in cleartext by inspecting the web administration panel's page source, exposing sensitive third-party authentication data that could be reused to pivot into connected systems such as mail servers, file transfer infrastructure, directory services, or SharePoint environments.
The issue requires authenticated administrative access to exploit, limiting the immediate blast radius, but the exposure of plaintext credentials for multiple integrated services raises the risk of lateral movement or further compromise if an attacker gains even limited administrative access, or if an insider abuses the flaw. The vulnerability was responsibly reported by Paweł Różański of Securitum and has been fixed in OptimiDoc Server version 26.08. Organizations running OptimiDoc Server (On-Premise) should upgrade to 26.08 or later and rotate credentials for any SMTP, FTP, Active Directory, or SharePoint integrations previously configured in the product.
Mentioned in this report
Source reporting: https://cert.pl/en/posts/2026/09/CVE-2026-15933
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs