OptimiDoc Server exposes cleartext service credentials
OptimiDoc Server (On-Premise) stored SMTP, FTP, AD, and SharePoint credentials in cleartext, viewable by admins via page source; fixed in v26.08.
CERT Polska coordinated disclosure of a vulnerability in OptimiDoc Server (On-Premise), tracked as CVE-2026-15933, in which credentials for integrated external services—SMTP, FTP (used for scan delivery), Active Directory (used for user list import), and SharePoint—were stored in cleartext. An authenticated administrator could retrieve these previously configured service passwords in cleartext by inspecting the web administration panel's page source, exposing sensitive third-party authentication data that could be reused to pivot into connected systems such as mail servers, file transfer infrastructure, directory services, or SharePoint environments.
The issue requires authenticated administrative access to exploit, limiting the immediate blast radius, but the exposure of plaintext credentials for multiple integrated services raises the risk of lateral movement or further compromise if an attacker gains even limited administrative access, or if an insider abuses the flaw. The vulnerability was responsibly reported by Paweł Różański of Securitum and has been fixed in OptimiDoc Server version 26.08. Organizations running OptimiDoc Server (On-Premise) should upgrade to 26.08 or later and rotate credentials for any SMTP, FTP, Active Directory, or SharePoint integrations previously configured in the product.
Mentioned in this report
Detection guidance
OptimiDoc Server Service Integration Credential Access
Detects authenticated access to OptimiDoc Server configuration endpoints that expose SMTP, FTP, Active Directory, or SharePoint credentials stored in plaintext configuration or HTML source. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: OptimiDoc Server Service Integration Credential Access
description: Detects HTTP requests to OptimiDoc Server configuration or integration
settings endpoints that may expose plaintext service credentials. Monitors for authenticated
admin access patterns to credential retrieval vectors.
tags:
- attack.credential-access
- attack.t1552.001
logsource:
category: proxy
product: any
detection:
selection_admin_auth:
url|contains:
- /admin/config
- /admin/integration
- /admin/settings
- /admin/mail
- /admin/ftp
- /admin/directory
- /admin/sharepoint
method:
- GET
- POST
selection_response_leak:
http_response_body|contains:
- smtp_password
- ftp_password
- ad_password
- ldap_password
- sharepoint_password
condition: selection_admin_auth and selection_response_leak
falsepositives:
- Routine administrative credential review or rotation by authorized IT staff
- OptimiDoc internal health checks or automated credential validation processes
level: medium
id: fc06f48f-5f4f-583c-bb3e-4ead1fa3737b
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/09/CVE-2026-15933
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free