TI-2026-01511 Aliases CVE-2026-1836 GHSA-w8cj-56rx-3gpm

Stored credentials in Redmine

LOW 25CWE-257Published 2026-06-12 · Updated 2026-06-12

Key facts

Attack vector: Local
Privileges required: Low
User interaction: Active
Attack complexity: Low
Attack requirements: Present
Impact type: —
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

The system stores the username and password from the login form after submitting the request. This could allow an attacker with access to the platform to return to the browser and view the login credentials.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00105 1st percentileScored 2026-11-07

Fix Fixed Redmine (Redmine): 6.0.7, 5.1.10, 5.0.14

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Redmine	Redmine	before 6.0.7; before 5.1.10; before 5.0.14	6.0.7, 5.1.10, 5.0.14	Patch available	CNA

Redmine VendorRedmine Affected before 6.0.7; before 5.1.10; before 5.0.14 Fixed in 6.0.7, 5.1.10, 5.0.14 Patch available CNA

Remediation

Fix · CNA Redmine (Redmine) Fixed in 6.0.7, 5.1.10, 5.0.14

Timeline

2026-10-02 Threatist record created from CVE-2026-1836
2026-10-03 Alias added: GHSA-w8cj-56rx-3gpm

References

Patch 1

https://www.incibe.es/en/incibe-cert/notices/aviso/stored-credentials-redmine

TI-2020-19240 PMB 5.6 - 'logid' SQL Injection CVSS 4.0HIGH 7.1
TI-2011-04243 Unspecified vulnerability in the bazaar repository adapter in Redmine 0.9.x and 1.0.x… CVSS 2.0HIGH 7.5
TI-2021-10704 Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to bypass the… CVSS 3.1CRITICAL 9.8
TI-2017-13235 Redmine before 3.2.9, 3.3.x before 3.3.6, and 3.4.x before 3.4.4 does not block the… CVSS 3.0HIGH 8.8
TI-2017-11378 Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles the rendering of wiki links, which… CVSS 3.0HIGH 7.5
TI-2017-11377 Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles Time Entry rendering in activity… CVSS 3.0HIGH 7.5

See all 52 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences