Redmine CVE-2026-1836

Exploitation requires the attacker to have local user-level access (PR:L) to the same browser profile on a device where a legitimate Redmine user previously submitted the login form (UI:A). The AT:P precondition means a specific situational condition applies: the victim's credentials must still be retained in browser storage and the attacker must be able to access that storage (e.g., same OS user session, shared profile, or physical access to an unlocked machine). Exploitation is strictly limited to local attack vectors - no network-facing exploitation path exists. Shared kiosks, shared developer workstations, or environments without session locking policies represent the highest-risk deployment contexts. The requirement for prior victim login interaction and local physical or session access directly limits the exploitable population to insider or physical access scenarios.

The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:L/UI:A) constrains real-world risk significantly despite the high vulnerable-system confidentiality and integrity impacts (VC:H/VI:H). AT:P signals that a specific attack precondition must be met - the attacker requires both local access to the device and a prior authenticated login event by the victim. UI:A further narrows the threat surface. This is not a remotely exploitable flaw; it is a post-authentication, local-access credential harvest scenario most relevant in shared-workstation or kiosk environments. No KEV listing exists, no POC is known, and EPSS data was not provided - the overall exploitation probability at scale is assessed as low. The primary realistic risk is insider threat or physical access scenarios, not broad internet-facing exploitation.

An attacker with local user access to a workstation - or an insider who temporarily uses an unlocked machine - opens the Redmine login page in the browser previously used by a legitimate user. The browser presents the stored username and password from the prior login submission, allowing the attacker to read or autofill the credentials without needing to crack any hash. No POC is required given the trivial nature of browser credential inspection once local access is obtained.