# OptimiDoc Server exposes cleartext service credentials

Published: 2026-09-03 · Severity: routine · Sectors: technology
Canonical: https://vorant.io/reports/dbefd9b7-7501-5a88-913a-e5197629a434/optimidoc-server-exposes-cleartext-service-credentials

> OptimiDoc Server (On-Premise) stored SMTP, FTP, AD, and SharePoint credentials in cleartext, viewable by admins via page source; fixed in v26.08.

CERT Polska coordinated disclosure of a vulnerability in OptimiDoc Server (On-Premise), tracked as CVE-2026-15933, in which credentials for integrated external services—SMTP, FTP (used for scan delivery), Active Directory (used for user list import), and SharePoint—were stored in cleartext. An authenticated administrator could retrieve these previously configured service passwords in cleartext by inspecting the web administration panel's page source, exposing sensitive third-party authentication data that could be reused to pivot into connected systems such as mail servers, file transfer infrastructure, directory services, or SharePoint environments.

The issue requires authenticated administrative access to exploit, limiting the immediate blast radius, but the exposure of plaintext credentials for multiple integrated services raises the risk of lateral movement or further compromise if an attacker gains even limited administrative access, or if an insider abuses the flaw. The vulnerability was responsibly reported by Paweł Różański of Securitum and has been fixed in OptimiDoc Server version 26.08. Organizations running OptimiDoc Server (On-Premise) should upgrade to 26.08 or later and rotate credentials for any SMTP, FTP, Active Directory, or SharePoint integrations previously configured in the product.

## Mentioned in this report

- Vulnerabilities: CVE-2026-15933

## Detection guidance (public sample)

### OptimiDoc Server Service Integration Credential Access

ATT&CK: T1552.001

Detects authenticated access to OptimiDoc Server configuration endpoints that expose SMTP, FTP, Active Directory, or SharePoint credentials stored in plaintext configuration or HTML source. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: OptimiDoc Server Service Integration Credential Access
description: Detects HTTP requests to OptimiDoc Server configuration or integration
  settings endpoints that may expose plaintext service credentials. Monitors for authenticated
  admin access patterns to credential retrieval vectors.
tags:
- attack.credential-access
- attack.t1552.001
logsource:
  category: proxy
  product: any
detection:
  selection_admin_auth:
    url|contains:
    - /admin/config
    - /admin/integration
    - /admin/settings
    - /admin/mail
    - /admin/ftp
    - /admin/directory
    - /admin/sharepoint
    method:
    - GET
    - POST
  selection_response_leak:
    http_response_body|contains:
    - smtp_password
    - ftp_password
    - ad_password
    - ldap_password
    - sharepoint_password
  condition: selection_admin_auth and selection_response_leak
falsepositives:
- Routine administrative credential review or rotation by authorized IT staff
- OptimiDoc internal health checks or automated credential validation processes
level: medium
id: fc06f48f-5f4f-583c-bb3e-4ead1fa3737b
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/09/CVE-2026-15933

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/dbefd9b7-7501-5a88-913a-e5197629a434/optimidoc-server-exposes-cleartext-service-credentials.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup