CVE-2026-15933 OptimiDoc CVE debrief

Who should care

Authenticated administrators of OptimiDoc Server (On-Premise) and users with access to sensitive external services should review and update credentials to prevent exposure of sensitive third-party authentication data. This includes reviewing and updating SMTP, FTP, Active Directory, and SharePoint credentials. Security teams and vulnerability management teams should also review the issue and plan for remediation.

Technical summary

OptimiDoc Server (On-Premise) stores credentials for external services in cleartext. An authenticated administrator can view previously configured service passwords, including SMTP, FTP (for scan delivery), Active Directory (for user list import), and SharePoint credentials, in cleartext via the web administration panel page source. This issue allows exposure of sensitive third-party authentication data. The vulnerability has a CVSS score of 6.9 and a severity of MEDIUM.

Defensive priority

Authenticated administrators should immediately review and update credentials for external services in OptimiDoc Server (On-Premise) to prevent exposure of sensitive third-party authentication data.

Recommended defensive actions

• Review and update credentials for external services in OptimiDoc Server (On-Premise) to prevent exposure of sensitive third-party authentication data.
• Implement secure storage for external service credentials.
• Monitor OptimiDoc Server (On-Premise) for unauthorized access to sensitive data.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE description indicates that OptimiDoc Server (On-Premise) stores credentials for external services in cleartext, allowing authenticated administrators to view previously configured service passwords in cleartext via the web administration panel page source. This issue was reported by [email protected] and affects OptimiDoc Server (On-Premise). Users should verify the accuracy of affected deployments and review service credentials.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.