Which versions of Streamsoft BI are affected by CVE-2026-50641?

Streamsoft Business Intelligence stores all user passwords in plaintext within its database, exposing every credential to anyone with database access.. A patch is available.

How to fix or mitigate CVE-2026-50641?

Within 24 hours, audit database access controls and identify accounts with direct database connectivity. Within 7 days, initiate deployment of Streamsoft BI version 6.8.0.0, which remediates plaintext password storage and enforces password reset on first login. Complete the upgrade organization-wide within 30 days, and monitor authentication logs for unauthorized access during the transition.

Streamsoft BI CVE-2026-50641

Q: What is the CVSS score of CVE-2026-50641?

CVE-2026-50641 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-50306 HIGH

Plaintext Storage of a Password (CWE-256)

2026-07-29 cvd@cert.pl

GHSA-v8g3-5gq5-j8gw

Information Disclosure

7.1

CVSS 4.0 · Vendor: cert

Severity by source

Vendor (cert) PRIMARY

7.1 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.7 MEDIUM

Reading stored plaintext passwords requires some access to the internal database (AV:A, PR:L); only credential confidentiality is affected, so I:N and A:N.

3.1 AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (cert).

CVSS VectorVendor: cert

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 29, 2026 - 14:02 EUVD

Analysis Generated

Jul 29, 2026 - 13:32 vuln.today

CVE Published

Jul 29, 2026 - 13:18 cve.org

HIGH 7.1

DescriptionCVE.org

Streamsoft Business Intelligence (BI) stores users' passwords in plaintext form in the database

This issue was fixed in version 6.8.0.0, users were also requested to change their password on the first login.

AnalysisAI

Plaintext password storage in Streamsoft Business Intelligence (BI) exposes every user's credential in recoverable form within the application database, meaning anyone able to read the database obtains working passwords directly rather than hashes. The flaw (CWE-256) affects all versions prior to 6.8.0.0, where the vendor introduced proper storage and forced a password change on first login after upgrade. There is no public exploit identified at time of analysis and it is not in CISA KEV; impact is confidentiality of credentials, amplified by likely password reuse across systems.

Technical ContextAI

Streamsoft BI is a business-intelligence/reporting component of the Streamsoft ERP suite (a Polish enterprise software vendor). The root cause is CWE-256, Plaintext Storage of a Password: user account passwords are persisted to the backend database without hashing, salting, or encryption. Because the credentials sit in cleartext, any read access to the relevant database table yields immediately usable secrets - no offline cracking of a hash is required. This is a storage/design weakness rather than a memory-corruption or injection bug, so no CPE list was supplied and the exact affected editions must be inferred from the vendor's fix note (all builds before 6.8.0.0).

RemediationAI

Vendor-released patch: upgrade to Streamsoft BI 6.8.0.0, which stores passwords securely; after upgrading, force every user to change their password on first login (the vendor explicitly requested this) so that any credential previously written in plaintext is rotated and rendered useless. Because pre-6.8 credentials may already exist in cleartext in live databases, backups, and replicas, treat all of them as compromised and rotate any reused passwords on other systems. If immediate upgrade is not possible, compensating controls are to tightly restrict and audit access to the BI database and its backups (network segmentation, least-privilege DB accounts, encryption of backup media) to limit who can read the plaintext table - noting this does not remove the underlying exposure and adds operational overhead. Refer to the CERT.pl advisory (https://cert.pl/posts/2026/07/CVE-2026-50641) and vendor page (https://www.streamsoft.pl/business-intelligence/).