OptimiDoc Server (On-Premise), document and print management software, stored the passwords it uses to reach other systems in plain text and showed them to any logged-in administrator who viewed the page source of the web administration panel. The flaw is tracked as CVE-2026-15933 and affects every version before 26.08, which fixes it.
The risk is not the document server itself but everything it is wired into. According to CERT Polska, which coordinated the disclosure, an authenticated administrator could read previously configured credentials for SMTP mail, the FTP account used to deliver scanned documents, the Active Directory account used to import user lists, and SharePoint.
The admin panel gave away everyone else's keys
The weakness is classed as CWE-256, plaintext storage of a password. The detail CERT Polska published is brief: credentials for those external services were stored in cleartext and exposed in the panel's page source, so an administrator, or anyone holding an administrator session, could collect authentication data for third-party systems that a document server had no business revealing. No CVSS score has been published, and the CERT bulletin does not link a vendor advisory, so any further detail on exploitation sits with OptimiDoc.
Service accounts of this kind are what make the finding matter. An Active Directory account with rights to enumerate users, or an SMTP relay credential, is a useful next step for an attacker who has already obtained an administrator login to a peripheral system. A similar credential-in-the-clear problem surfaced in backup software last month, in the Veeam bug that wrote server credentials into plain text logs.
Update to 26.08, then change the passwords it exposed
The fix is to upgrade OptimiDoc Server (On-Premise) to version 26.08 or later. Because the flaw exposed stored credentials rather than a code path, administrators would be prudent to treat the SMTP, FTP, Active Directory and SharePoint accounts configured in older installations as potentially viewed, and rotate them after upgrading. Restricting who holds administrator access to the panel limits the exposure in the meantime.
The vulnerability was reported to CERT Polska by Paweł Różański of Securitum, and the CERT took part in coordinating its disclosure with the vendor under Poland's national coordinated vulnerability disclosure process. The original CERT Polska advisory carries the record.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.