Executive brief
OptimiDoc Server is an on-premise document management system used to manage workflows and integrate with external services. The application stores passwords for critical integrations (SMTP for email, FTP for scan delivery, Active Directory for user management, and SharePoint) in plaintext in web pages. An authenticated administrator can view these credentials by inspecting the page source, exposing passwords to multiple third-party systems and risking unauthorized access to those services.
Technical details
OptimiDoc Server (On-Premise) suffers from CWE-256: Plaintext Storage of a Password. The vulnerability exists in the web administration panel, where previously configured credentials for external services (SMTP, FTP, Active Directory, SharePoint) are stored and rendered in cleartext in the HTML page source. An authenticated administrator with access to the web interface can easily view these secrets without additional authorization or technical steps—simply by viewing the page source or inspecting network traffic. This allows exposure of credentials to multiple third-party systems. The vulnerability was fixed in version 26.08; all prior versions are affected.
Affected products
- OptimiDoc OptimiDoc Server before 26.08
Timeline
- 2026-09-03: disclosed
- 2026-09-03: patched: Fixed in version 26.08