CVE-2026-50641

Streamsoft Business Intelligence (BI) stores users' passwords in plaintext form in the database This issue was fixed in version 6.8.0.0, users were also requested to change their password on the first login.

CVSS

No CVSS.

References

Link	Resource
https://cert.pl/posts/2026/07/CVE-2026-50641
https://www.streamsoft.pl/business-intelligence/

Configurations

No configuration.

History

23 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Streamsoft Business Intelligence (BI) almacena las contraseñas de los usuarios en texto plano en la base de datos. Este problema se solucionó en la versión 6.8.0.0, y también se solicitó a los usuarios que cambiaran su contraseña en el primer inicio de sesión.

Information

Published : 2026-07-29 13:18

Updated : 2026-10-23 23:10

NVD link : CVE-2026-50641

Mitre link : CVE-2026-50641

CVE.ORG link : CVE-2026-50641

JSON object : View

Products Affected

No product.

CWE

CWE-256

Plaintext Storage of a Password

{"id": "CVE-2026-50641", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-50641", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-29T14:18:12.306816Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cvd@cert.pl", "affectedData": [{"vendor": "Streamsoft", "product": "Business Intelligence", "versions": [{"status": "affected", "version": "0", "lessThan": "6.8.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-29T13:18:53.053", "references": [{"url": "https://cert.pl/posts/2026/07/CVE-2026-50641", "source": "cvd@cert.pl"}, {"url": "https://www.streamsoft.pl/business-intelligence/", "source": "cvd@cert.pl"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-256"}]}], "descriptions": [{"lang": "en", "value": "Streamsoft Business Intelligence (BI) stores users' passwords in plaintext form in the database\n\nThis issue was fixed in version\u00a06.8.0.0, users were also requested to change their password on the first login."}, {"lang": "es", "value": "Streamsoft Business Intelligence (BI) almacena las contrase\u00f1as de los usuarios en texto plano en la base de datos.\n\nEste problema se solucion\u00f3 en la versi\u00f3n 6.8.0.0, y tambi\u00e9n se solicit\u00f3 a los usuarios que cambiaran su contrase\u00f1a en el primer inicio de sesi\u00f3n."}], "lastModified": "2026-10-23T23:10:00.157", "sourceIdentifier": "cvd@cert.pl"}