Redmine CVE-2026-1836

Q: What is the CVSS score of CVE-2026-1836?

CVE-2026-1836 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

Q: Is there a patch available for CVE-2026-1836?

Yes, a patch is available for CVE-2026-1836. Update the affected software to the latest version immediately.

EUVD-2026-36424 MEDIUM

Storing Passwords in a Recoverable Format (CWE-257)

2026-06-12 INCIBE

GHSA-w8cj-56rx-3gpm

Information Disclosure Redmine

5.3

CVSS 4.0 · Vendor: INCIBE

Severity by source

Vendor (INCIBE) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.6 MEDIUM

Local access and prior victim login interaction required (PR:L, UI:R); credentials fully exposed upon access (C:H/I:H), no availability impact.

3.1 AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

4.0 AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (INCIBE).

CVSS VectorVendor: INCIBE

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 12, 2026 - 14:21 vuln.today

DescriptionCVE.org

The system stores the username and password from the login form after submitting the request. This could allow an attacker with access to the platform to return to the browser and view the login credentials.

AnalysisAI

Credential exposure in Redmine allows any local attacker with access to a previously-used browser session to recover plaintext login credentials stored by the application after form submission. The flaw (CWE-257) affects all tracked Redmine versions per NVD CPE data and represents a classic insecure credential storage issue. No public exploit has been identified at time of analysis, and exploitation is constrained to local attack vectors requiring prior user interaction.

Technical ContextAI

CWE-257 (Storing Passwords in a Recoverable Format) describes the root cause: Redmine's login form retains submitted credentials in a browser-accessible, recoverable state after the authentication request is processed - likely via browser autocomplete persistence, form cache, or equivalent browser storage mechanism. The CPE string cpe:2.3:a:redmine:redmine:*:*:*:*:*:*:*:* covers all versions of the Redmine project management application. The vulnerability is application-layer: Redmine fails to clear or protect submitted form data post-submission, leaving credentials readable within the browser environment rather than being discarded after use.

RemediationAI

A vendor patch is available per the INCIBE advisory at https://www.incibe.es/en/incibe-cert/notices/aviso/stored-credentials-redmine - administrators should consult this advisory and apply the patched Redmine release; the exact fixed version number is not independently confirmed from currently available data. As a compensating control pending patching, administrators should configure Redmine's login form with autocomplete='off' to prevent browser credential caching, though this depends on browser enforcement and may affect usability. Users on shared systems should manually clear browser-saved form data after each session. Organizations should enforce browser policies via GPO or MDM to disable credential autofill on sensitive internal applications. Restricting physical and session access to workstations used to access Redmine is the most effective short-term compensating control, with the trade-off of operational friction on shared infrastructure.