Redmine up to 5.0.13/5.1.9/6.0.6 password recoverable

Summaryinfo

A vulnerability described as problematic has been identified in Redmine up to 5.0.13/5.1.9/6.0.6. Affected is an unknown function. The manipulation results in password recoverable. This vulnerability was named CVE-2026-1836. The attack needs to be approached locally. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Redmine up to 5.0.13/5.1.9/6.0.6. Affected is an unknown code block. The manipulation with an unknown input leads to a password recoverable vulnerability. CWE is classifying the issue as CWE-257. The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts. This is going to have an impact on confidentiality. CVE summarizes:

The system stores the username and password from the login form after submitting the request. This could allow an attacker with access to the platform to return to the browser and view the login credentials.

The advisory is available at incibe.es. This vulnerability is traded as CVE-2026-1836 since 02/03/2026. The exploitability is told to be easy. Local access is required to approach this attack. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1552 by the MITRE ATT&CK project.

Upgrading to version 5.0.14, 5.1.10 or 6.0.7 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Project Management Software

Name

• Redmine

Version

• 5.0.0
• 5.0.1
• 5.0.2
• 5.0.3
• 5.0.4
• 5.0.5
• 5.0.6
• 5.0.7
• 5.0.8
• 5.0.9
• 5.0.10
• 5.0.11
• 5.0.12
• 5.0.13
• 5.1.0
• 5.1.1
• 5.1.2
• 5.1.3
• 5.1.4
• 5.1.5
• 5.1.6
• 5.1.7
• 5.1.8
• 5.1.9
• 6.0.0
• 6.0.1
• 6.0.2
• 6.0.3
• 6.0.4
• 6.0.5
• 6.0.6

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion