CVE-2026-1836: Stored credentials in Redmine

Record summary

CVE-2026-1836 has a selected CVSS score of 5.3 (medium).

Description

The system stores the username and password from the login form after submitting the request. This could allow an attacker with access to the platform to return to the browser and view the login credentials.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone

AutomatableNo

Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 12, 2026 · Source: CVE List

Affected products and versions

Product	Source	Version range	Status
Redmine Browse Redmine / Redmine Default status: unaffected	CVE List	Before 6.0.7	affected
		Before 5.1.10	affected
		Before 5.0.14	affected
		6.0.7	unaffected
		5.1.10	unaffected
		5.0.14	unaffected

References

nvd.nist.gov

https://nvd.nist.gov/vuln/detail/CVE-2026-1836

incibe.espatch

https://www.incibe.es/en/incibe-cert/notices/aviso/stored-credentials-redmine